@qwen-code/qwen-code 0.23.0 → 0.23.1-preview.1

package/chunks/chunk-JPEAQJNS.js

@@ -0,0 +1,2142 @@
+// Force strict mode and setup for ESM
+"use strict";
+import {
+  isActiveWorkflowStatus,
+  isTerminalWorkflowStatus,
+  isWorkflowRunPersistenceActive
+} from "./chunk-I72PHOKL.js";
+import {
+  atomicWriteFile
+} from "./chunk-XFFRI3WM.js";
+import {
+  stripAnsiAndControl
+} from "./chunk-7VEYUF3N.js";
+import {
+  Storage,
+  createDebugLogger
+} from "./chunk-ZAFYHRVY.js";
+import {
+  init_esbuild_shims
+} from "./chunk-5O2XNYP6.js";
+import {
+  __name
+} from "./chunk-J2S4EL5Y.js";
+
+// packages/core/src/agents/runtime/workflow-sandbox.ts
+init_esbuild_shims();
+import * as vm from "node:vm";
+
+// packages/core/src/agents/runtime/workflow-meta-literal.ts
+init_esbuild_shims();
+var WorkflowMetaSyntaxError = class extends Error {
+  static {
+    __name(this, "WorkflowMetaSyntaxError");
+  }
+  index;
+  constructor(message, index) {
+    super(message);
+    this.name = "WorkflowMetaSyntaxError";
+    this.index = index;
+  }
+};
+function parseWorkflowMetaLiteral(source) {
+  const parser = new MetaLiteralParser(source);
+  parser.skipTrivia();
+  const value = parser.parseValue(0);
+  parser.skipTrivia();
+  if (parser.index < source.length) {
+    throw parser.fail("unexpected trailing content");
+  }
+  return value;
+}
+__name(parseWorkflowMetaLiteral, "parseWorkflowMetaLiteral");
+var MAX_DEPTH = 32;
+var WHITESPACE = /* @__PURE__ */ new Set([" ", "	", "\n", "\r", "\f", "\v", "\xA0", "\uFEFF"]);
+var ID_START = /[A-Za-z_$]/;
+var ID_PART = /[A-Za-z0-9_$]/;
+var MetaLiteralParser = class {
+  constructor(src) {
+    this.src = src;
+  }
+  static {
+    __name(this, "MetaLiteralParser");
+  }
+  index = 0;
+  fail(message) {
+    const from = Math.max(0, this.index - 24);
+    const snippet = this.src.slice(from, this.index + 24).replace(/\s+/g, " ").trim();
+    return new WorkflowMetaSyntaxError(
+      `${message} at position ${this.index} (near "${snippet}"). meta must be a plain object literal \u2014 strings, numbers, booleans, null, arrays and objects only, with no variables, function calls, spreads, accessors or template substitutions.`,
+      this.index
+    );
+  }
+  skipTrivia() {
+    for (; ; ) {
+      while (this.index < this.src.length && WHITESPACE.has(this.src[this.index])) {
+        this.index++;
+      }
+      if (this.src.startsWith("//", this.index)) {
+        let end = this.index + 2;
+        while (end < this.src.length && !"\n\r\u2028\u2029".includes(this.src[end])) {
+          end++;
+        }
+        if (this.src[end] === "\r" && this.src[end + 1] === "\n") end++;
+        this.index = end < this.src.length ? end + 1 : this.src.length;
+        continue;
+      }
+      if (this.src.startsWith("/*", this.index)) {
+        const end = this.src.indexOf("*/", this.index + 2);
+        if (end === -1) throw this.fail("unterminated comment");
+        this.index = end + 2;
+        continue;
+      }
+      return;
+    }
+  }
+  parseValue(depth) {
+    if (depth > MAX_DEPTH) throw this.fail("meta literal is nested too deeply");
+    this.skipTrivia();
+    const c = this.src[this.index];
+    if (c === void 0) throw this.fail("unexpected end of meta literal");
+    if (c === "{") return this.parseObject(depth);
+    if (c === "[") return this.parseArray(depth);
+    if (c === '"' || c === "'" || c === "`") return this.parseString();
+    if (c === "-" || c >= "0" && c <= "9") return this.parseNumber();
+    if (this.src.startsWith("true", this.index)) return this.word("true", true);
+    if (this.src.startsWith("false", this.index)) {
+      return this.word("false", false);
+    }
+    if (this.src.startsWith("null", this.index)) return this.word("null", null);
+    if (c === "/")
+      throw this.fail("regular expressions are not allowed in meta");
+    throw this.fail("unsupported value");
+  }
+  word(literal, value) {
+    const after = this.src[this.index + literal.length];
+    if (after !== void 0 && ID_PART.test(after)) {
+      throw this.fail("unsupported value");
+    }
+    this.index += literal.length;
+    return value;
+  }
+  parseObject(depth) {
+    this.index++;
+    const out = /* @__PURE__ */ Object.create(null);
+    for (; ; ) {
+      this.skipTrivia();
+      const c = this.src[this.index];
+      if (c === "}") {
+        this.index++;
+        return out;
+      }
+      if (c === void 0) throw this.fail("unterminated object");
+      if (this.src.startsWith("...", this.index)) {
+        throw this.fail("spread is not allowed in meta");
+      }
+      if (c === "[") throw this.fail("computed keys are not allowed in meta");
+      const key = this.parseKey();
+      this.skipTrivia();
+      if (this.src[this.index] === "(") {
+        throw this.fail("methods are not allowed in meta");
+      }
+      if (this.src[this.index] !== ":")
+        throw this.fail('expected ":" after key');
+      this.index++;
+      out[key] = this.parseValue(depth + 1);
+      this.skipTrivia();
+      if (this.src[this.index] === ",") {
+        this.index++;
+        continue;
+      }
+      if (this.src[this.index] === "}") {
+        this.index++;
+        return out;
+      }
+      throw this.fail('expected "," or "}"');
+    }
+  }
+  parseKey() {
+    const c = this.src[this.index];
+    if (c === '"' || c === "'" || c === "`") return this.parseString();
+    if (c !== void 0 && ID_START.test(c)) {
+      const start = this.index;
+      while (this.index < this.src.length && ID_PART.test(this.src[this.index])) {
+        this.index++;
+      }
+      const word = this.src.slice(start, this.index);
+      if (word === "get" || word === "set" || word === "async") {
+        const save = this.index;
+        this.skipTrivia();
+        const next = this.src[this.index];
+        const startsPropertyName = next !== void 0 && (ID_START.test(next) || next === '"' || next === "'" || next === "[");
+        this.index = save;
+        if (startsPropertyName) {
+          throw this.fail(
+            word === "async" ? "async members are not allowed in meta" : `${word}ters are not allowed in meta`
+          );
+        }
+      }
+      return word;
+    }
+    throw this.fail("expected a property name");
+  }
+  parseArray(depth) {
+    this.index++;
+    const out = [];
+    for (; ; ) {
+      this.skipTrivia();
+      const c = this.src[this.index];
+      if (c === "]") {
+        this.index++;
+        return out;
+      }
+      if (c === void 0) throw this.fail("unterminated array");
+      if (this.src.startsWith("...", this.index)) {
+        throw this.fail("spread is not allowed in meta");
+      }
+      if (c === ",") throw this.fail("missing array element");
+      out.push(this.parseValue(depth + 1));
+      this.skipTrivia();
+      if (this.src[this.index] === ",") {
+        this.index++;
+        continue;
+      }
+      if (this.src[this.index] === "]") {
+        this.index++;
+        return out;
+      }
+      throw this.fail('expected "," or "]"');
+    }
+  }
+  parseString() {
+    const quote = this.src[this.index++];
+    let out = "";
+    for (; ; ) {
+      const c = this.src[this.index];
+      if (c === void 0) throw this.fail("unterminated string");
+      if (c === quote) {
+        this.index++;
+        return out;
+      }
+      if (c === "\n" || c === "\r") {
+        if (quote !== "`") throw this.fail("unterminated string");
+        if (c === "\r") {
+          this.index++;
+          if (this.src[this.index] === "\n") this.index++;
+          out += "\n";
+          continue;
+        }
+      }
+      if (quote === "`" && c === "$" && this.src[this.index + 1] === "{") {
+        throw this.fail("template substitutions are not allowed in meta");
+      }
+      if (c === "\\") {
+        out += this.parseEscape();
+        continue;
+      }
+      out += c;
+      this.index++;
+    }
+  }
+  parseEscape() {
+    this.index++;
+    const c = this.src[this.index++];
+    switch (c) {
+      case "n":
+        return "\n";
+      case "t":
+        return "	";
+      case "r":
+        return "\r";
+      case "b":
+        return "\b";
+      case "f":
+        return "\f";
+      case "v":
+        return "\v";
+      case "0":
+        if (/[0-9]/.test(this.src[this.index] ?? "")) {
+          throw this.fail("octal escapes are not allowed in meta");
+        }
+        return "\0";
+      case "x": {
+        const hex = this.src.slice(this.index, this.index + 2);
+        if (!/^[0-9a-fA-F]{2}$/.test(hex)) {
+          throw this.fail("invalid \\x escape");
+        }
+        this.index += 2;
+        return String.fromCharCode(parseInt(hex, 16));
+      }
+      case "u": {
+        if (this.src[this.index] === "{") {
+          const end = this.src.indexOf("}", this.index);
+          const hex2 = end === -1 ? "" : this.src.slice(this.index + 1, end);
+          if (!/^[0-9a-fA-F]{1,6}$/.test(hex2)) {
+            throw this.fail("invalid \\u{...} escape");
+          }
+          const code = parseInt(hex2, 16);
+          if (code > 1114111) throw this.fail("invalid \\u{...} escape");
+          this.index = end + 1;
+          return String.fromCodePoint(code);
+        }
+        const hex = this.src.slice(this.index, this.index + 4);
+        if (!/^[0-9a-fA-F]{4}$/.test(hex)) {
+          throw this.fail("invalid \\u escape");
+        }
+        this.index += 4;
+        return String.fromCharCode(parseInt(hex, 16));
+      }
+      case "\n":
+        return "";
+      // line continuation
+      case "\r":
+        if (this.src[this.index] === "\n") this.index++;
+        return "";
+      case "\u2028":
+      case "\u2029":
+        return "";
+      case void 0:
+        throw this.fail("unterminated escape sequence");
+      default:
+        return c;
+    }
+  }
+  parseNumber() {
+    const start = this.index;
+    if (this.src[this.index] === "-") this.index++;
+    while (this.index < this.src.length && /[0-9]/.test(this.src[this.index])) {
+      this.index++;
+    }
+    if (this.src[this.index] === ".") {
+      this.index++;
+      while (this.index < this.src.length && /[0-9]/.test(this.src[this.index])) {
+        this.index++;
+      }
+    }
+    if (this.src[this.index] === "e" || this.src[this.index] === "E") {
+      this.index++;
+      if (this.src[this.index] === "+" || this.src[this.index] === "-") {
+        this.index++;
+      }
+      while (this.index < this.src.length && /[0-9]/.test(this.src[this.index])) {
+        this.index++;
+      }
+    }
+    const after = this.src[this.index];
+    if (after !== void 0 && ID_PART.test(after)) {
+      throw this.fail("unsupported numeric literal");
+    }
+    const text = this.src.slice(start, this.index);
+    const value = Number(text);
+    if (text.length === 0 || !Number.isFinite(value)) {
+      throw this.fail("unsupported numeric literal");
+    }
+    return value;
+  }
+};
+
+// packages/core/src/agents/runtime/workflow-sandbox.ts
+function findMetaBlockBounds(source) {
+  const re = /^\s*export\s+const\s+meta\s*=\s*\{/;
+  const match = re.exec(source);
+  if (!match) return null;
+  const exportIdx = match.index;
+  const startBrace = source.indexOf("{", exportIdx);
+  let depth = 1;
+  let i = startBrace + 1;
+  while (i < source.length && depth > 0) {
+    const ch = source[i];
+    const next = source[i + 1];
+    if (ch === "/" && next === "/") {
+      i += 2;
+      while (i < source.length && source[i] !== "\n") i++;
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      i += 2;
+      while (i < source.length && !(source[i] === "*" && source[i + 1] === "/"))
+        i++;
+      i += 2;
+      continue;
+    }
+    if (ch === "/" && isRegexContext(source, i)) {
+      i++;
+      let inClass = false;
+      while (i < source.length && (inClass || source[i] !== "/") && source[i] !== "\n") {
+        if (source[i] === "\\") i += 2;
+        else if (source[i] === "[") {
+          inClass = true;
+          i++;
+        } else if (source[i] === "]") {
+          inClass = false;
+          i++;
+        } else {
+          i++;
+        }
+      }
+      i++;
+      while (i < source.length && /[gimsuy]/.test(source[i])) i++;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      const q = ch;
+      i++;
+      while (i < source.length && source[i] !== q) {
+        if (source[i] === "\\") i++;
+        i++;
+      }
+      i++;
+      continue;
+    }
+    if (ch === "{") depth++;
+    else if (ch === "}") depth--;
+    i++;
+  }
+  if (depth !== 0) {
+    throw new Error(
+      "unbalanced braces in export const meta declaration \u2014 the workflow script cannot be safely stripped. Check the meta block syntax."
+    );
+  }
+  const endBraceIncl = i - 1;
+  while (i < source.length && /[\s;]/.test(source[i])) i++;
+  return { exportIdx, startBrace, endBraceIncl, afterMeta: i };
+}
+__name(findMetaBlockBounds, "findMetaBlockBounds");
+function extractAndStripMeta(source) {
+  const bounds = findMetaBlockBounds(source);
+  if (!bounds) return { stripped: source, meta: null };
+  const metaSource = source.slice(bounds.startBrace, bounds.endBraceIncl + 1);
+  const stripped = source.slice(0, bounds.exportIdx) + source.slice(bounds.afterMeta);
+  let raw;
+  try {
+    raw = parseWorkflowMetaLiteral(metaSource);
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    throw new Error(`invalid meta object literal: ${msg}`);
+  }
+  const meta = validateMeta(raw);
+  return { stripped, meta };
+}
+__name(extractAndStripMeta, "extractAndStripMeta");
+var WORKFLOW_SCRIPT_FILENAME = "workflow.js";
+function wrapWorkflowBody(strippedSource) {
+  return `(async () => {'use strict';
+${strippedSource}
+})()`;
+}
+__name(wrapWorkflowBody, "wrapWorkflowBody");
+function compileWorkflowScript(scriptSource) {
+  const { stripped, meta } = extractAndStripMeta(scriptSource);
+  const bounds = findMetaBlockBounds(scriptSource);
+  const compilable = bounds ? scriptSource.slice(0, bounds.exportIdx) + scriptSource.slice(bounds.exportIdx, bounds.afterMeta).replace(/[^\r\n\u2028\u2029]/g, " ") + scriptSource.slice(bounds.afterMeta) : stripped;
+  const script = new vm.Script(wrapWorkflowBody(compilable), {
+    filename: WORKFLOW_SCRIPT_FILENAME
+  });
+  return { script, meta };
+}
+__name(compileWorkflowScript, "compileWorkflowScript");
+function workflowCancelledError() {
+  const error = new Error("Workflow run was aborted (cancelled).");
+  error.name = "AbortError";
+  return error;
+}
+__name(workflowCancelledError, "workflowCancelledError");
+var COMPILE_ERROR_LINE_WIDTH = 80;
+function describeWorkflowCompileError(error, authorLineCount) {
+  const err = error instanceof Error ? error : new Error(String(error));
+  const stack = typeof err.stack === "string" ? err.stack : "";
+  const frame = [];
+  for (const line of stack.split("\n")) {
+    if (frame.length >= 3 && /^\s+at\s/.test(line)) break;
+    frame.push(line);
+  }
+  const header = frame[0] ?? "";
+  const match = /^.*?:(\d+)$/.exec(header);
+  if (frame.length < 3 || !match) {
+    return err.message;
+  }
+  const bodyLine = Number(match[1]) - 1;
+  if (bodyLine < 1) return err.message;
+  if (bodyLine > authorLineCount) {
+    return "The script ends with unmatched or incomplete syntax. Check parentheses, brackets, braces, quotes, and template literals near the end.";
+  }
+  const rendered = clampSourceFrame(frame[1] ?? "", frame[2] ?? "");
+  const tail = frame.slice(3).filter((l) => l.trim().length > 0).join("\n");
+  return [`line ${bodyLine}`, rendered, tail].filter(Boolean).join("\n");
+}
+__name(describeWorkflowCompileError, "describeWorkflowCompileError");
+function clampSourceFrame(sourceLine, caretLine) {
+  if (sourceLine.length <= COMPILE_ERROR_LINE_WIDTH) {
+    return `${sourceLine}
+${caretLine}`;
+  }
+  const caret = /\^+/.exec(caretLine);
+  if (!caret) return "";
+  const caretCol = caret.index;
+  const start = Math.max(
+    0,
+    Math.min(
+      caretCol - Math.floor(COMPILE_ERROR_LINE_WIDTH / 2),
+      sourceLine.length - COMPILE_ERROR_LINE_WIDTH
+    )
+  );
+  const prefix = start > 0 ? "\u2026" : "";
+  const window = sourceLine.slice(start, start + COMPILE_ERROR_LINE_WIDTH);
+  const suffix = start + COMPILE_ERROR_LINE_WIDTH < sourceLine.length ? "\u2026" : "";
+  const visibleCaretStart = Math.max(caretCol, start);
+  const visibleCaretEnd = Math.min(
+    caretCol + caret[0].length,
+    start + COMPILE_ERROR_LINE_WIDTH
+  );
+  const shiftedCaret = " ".repeat(prefix.length + visibleCaretStart - start) + "^".repeat(visibleCaretEnd - visibleCaretStart);
+  return `${prefix}${window}${suffix}
+${shiftedCaret}`;
+}
+__name(clampSourceFrame, "clampSourceFrame");
+function validateMeta(value) {
+  if (value === null || typeof value !== "object") {
+    throw new Error("meta must be an object");
+  }
+  const obj = value;
+  if (typeof obj["name"] !== "string" || obj["name"].length === 0) {
+    throw new Error("meta.name must be a non-empty string");
+  }
+  if (typeof obj["description"] !== "string" || obj["description"].length === 0) {
+    throw new Error("meta.description must be a non-empty string");
+  }
+  if (obj["whenToUse"] !== void 0 && typeof obj["whenToUse"] !== "string") {
+    throw new Error("meta.whenToUse must be a string");
+  }
+  let phases;
+  if (obj["phases"] !== void 0) {
+    if (!Array.isArray(obj["phases"])) {
+      throw new Error("meta.phases must be an array");
+    }
+    phases = [];
+    for (const p of obj["phases"]) {
+      if (p === null || typeof p !== "object") {
+        throw new Error("meta.phases entries must be objects");
+      }
+      const ph = p;
+      if (typeof ph["title"] !== "string" || ph["title"].length === 0) {
+        throw new Error("meta.phases[].title must be a non-empty string");
+      }
+      const phase = {
+        title: ph["title"]
+      };
+      if (ph["detail"] !== void 0) {
+        if (typeof ph["detail"] !== "string") {
+          throw new Error("meta.phases[].detail must be a string");
+        }
+        phase.detail = ph["detail"];
+      }
+      if (ph["model"] !== void 0) {
+        if (typeof ph["model"] !== "string") {
+          throw new Error("meta.phases[].model must be a string");
+        }
+        phase.model = ph["model"];
+      }
+      phases.push(phase);
+    }
+  }
+  const out = {
+    name: obj["name"],
+    description: obj["description"]
+  };
+  if (obj["whenToUse"] !== void 0) {
+    out.whenToUse = obj["whenToUse"];
+  }
+  if (phases !== void 0) {
+    out.phases = phases;
+  }
+  return out;
+}
+__name(validateMeta, "validateMeta");
+function isRegexContext(source, i) {
+  let j = i - 1;
+  while (j >= 0 && /\s/.test(source[j])) j--;
+  if (j < 0) return true;
+  const prev = source[j];
+  return /[{[(,;:=!&|?+\-*/%^~<>]/.test(prev);
+}
+__name(isRegexContext, "isRegexContext");
+var debugLogger = createDebugLogger("WORKFLOW");
+var MAX_LOG_LINES = 1e4;
+var MAX_PHASE_ENTRIES = 1e4;
+var ARGS_MAX_DEPTH = 64;
+var DEFAULT_MAX_WALL_CLOCK_MS = 30 * 60 * 1e3;
+function resolveMaxWallClockMs(opts) {
+  if (typeof opts.maxWallClockMs === "number" && opts.maxWallClockMs > 0) {
+    return opts.maxWallClockMs;
+  }
+  const envSec = Number(process.env["QWEN_CODE_MAX_WORKFLOW_SECONDS"]);
+  if (Number.isFinite(envSec) && envSec > 0) return envSec * 1e3;
+  return DEFAULT_MAX_WALL_CLOCK_MS;
+}
+__name(resolveMaxWallClockMs, "resolveMaxWallClockMs");
+var WallClockWatchdog = class {
+  constructor(budgetMs, onFire) {
+    this.onFire = onFire;
+    this.remainingMs = budgetMs;
+    this.arm();
+  }
+  static {
+    __name(this, "WallClockWatchdog");
+  }
+  timer;
+  remainingMs;
+  armedAt = 0;
+  paused = false;
+  stopped = false;
+  pause() {
+    if (this.stopped || this.paused || this.timer === void 0) return;
+    this.paused = true;
+    clearTimeout(this.timer);
+    this.timer = void 0;
+    this.remainingMs = Math.max(
+      0,
+      this.remainingMs - (performance.now() - this.armedAt)
+    );
+  }
+  resume() {
+    if (this.stopped || !this.paused) return;
+    this.paused = false;
+    this.arm();
+  }
+  stop() {
+    this.stopped = true;
+    if (this.timer !== void 0) clearTimeout(this.timer);
+    this.timer = void 0;
+  }
+  arm() {
+    this.armedAt = performance.now();
+    this.timer = setTimeout(() => {
+      this.stopped = true;
+      this.timer = void 0;
+      this.onFire();
+    }, this.remainingMs);
+    this.timer.unref?.();
+  }
+};
+function validateArgs(val, depth = 0, seen = /* @__PURE__ */ new WeakSet()) {
+  if (depth > ARGS_MAX_DEPTH) {
+    throw new Error(
+      `WorkflowSandbox: args exceeded max nesting depth of ${ARGS_MAX_DEPTH}`
+    );
+  }
+  if (val === null) return;
+  const t = typeof val;
+  if (t === "function") {
+    throw new Error(
+      "WorkflowSandbox: args must be JSON-serializable (functions are not allowed)."
+    );
+  }
+  if (t === "bigint") {
+    throw new Error(
+      "WorkflowSandbox: args must be JSON-serializable (BigInt is not allowed \u2014 pass as string)."
+    );
+  }
+  if (t !== "object") return;
+  const obj = val;
+  if (seen.has(obj)) {
+    throw new Error(
+      "WorkflowSandbox: args must be JSON-serializable (circular reference detected)."
+    );
+  }
+  seen.add(obj);
+  if (Array.isArray(val)) {
+    for (const item of val) validateArgs(item, depth + 1, seen);
+  } else {
+    for (const v of Object.values(val)) {
+      validateArgs(v, depth + 1, seen);
+    }
+  }
+}
+__name(validateArgs, "validateArgs");
+function createWorkflowSandbox(opts) {
+  const phases = [];
+  const logs = [];
+  const emitLog = /* @__PURE__ */ __name((line) => {
+    try {
+      opts.emitter?.logAppended?.(line);
+    } catch (e) {
+      debugLogger.warn("emitter.logAppended threw:", e);
+    }
+  }, "emitLog");
+  const safeLog = /* @__PURE__ */ __name((msg, notify = true) => {
+    if (logs.length < MAX_LOG_LINES) {
+      const line = String(msg);
+      logs.push(line);
+      if (notify) emitLog(line);
+    } else if (logs.length === MAX_LOG_LINES) {
+      const line = `[workflow log truncated at ${MAX_LOG_LINES} lines]`;
+      logs.push(line);
+      if (notify) emitLog(line);
+    }
+  }, "safeLog");
+  const safePhase = /* @__PURE__ */ __name((title) => {
+    if (phases.length < MAX_PHASE_ENTRIES) {
+      const t = stripAnsiAndControl(String(title)).slice(0, 200) || "phase";
+      if (phases[phases.length - 1] === t) return;
+      phases.push(t);
+      try {
+        opts.emitter?.phaseStarted?.(t);
+      } catch (e) {
+        debugLogger.warn("emitter.phaseStarted threw:", e);
+      }
+    } else if (phases.length === MAX_PHASE_ENTRIES) {
+      phases.push(
+        `[workflow phases truncated at ${MAX_PHASE_ENTRIES} entries]`
+      );
+    }
+  }, "safePhase");
+  if (opts.args !== void 0) validateArgs(opts.args);
+  const argsJson = opts.args === void 0 ? null : JSON.stringify(opts.args);
+  const unconsumedRoots = /* @__PURE__ */ new Map();
+  const unconsumedRejections = /* @__PURE__ */ new Map();
+  let nextUnconsumedId = 1;
+  let unconsumedSettled = false;
+  let mirroredEscapeKeys = /* @__PURE__ */ new Set();
+  const unconsumedRejectionLine = /* @__PURE__ */ __name((rec) => {
+    if (rec.dispatchFailed) {
+      return rec.isRoot ? "dispatch failed (result not consumed): " + rec.msg : "dispatch failed (rejection not handled): " + rec.msg;
+    }
+    return "script handler failed (rejection not handled): " + rec.msg;
+  }, "unconsumedRejectionLine");
+  const bridge = {
+    argsJson,
+    pushPhase: safePhase,
+    pushLog: safeLog,
+    lastPhase: /* @__PURE__ */ __name(() => phases[phases.length - 1], "lastPhase"),
+    hostAgent: opts.dispatch,
+    // PR #4947 R2 T7 (qwen-code-ci-bot): host-side log hook for reviveInRealm's
+    // catch path. Mirrors the rejection-logging in settleToNullArray so an
+    // operator running with debug logging can distinguish "thunk rejected"
+    // (settleToNullArray.warn) from "thunk resolved to a non-JSON-serializable
+    // value" (this warn). Receives only primitive strings/numbers — the bridge
+    // contract forbids host objects crossing back to the script.
+    logRevivalFailure: /* @__PURE__ */ __name((idx, reason) => {
+      debugLogger.warn(
+        `Workflow result revival failed at index ${idx}: ${reason}; slot set to null (non-JSON-serializable thunk return).`
+      );
+    }, "logRevivalFailure"),
+    // --- Unconsumed-rejection mirror bookkeeping ---
+    wfRegisterRoot: /* @__PURE__ */ __name(() => {
+      const id = nextUnconsumedId++;
+      unconsumedRoots.set(id, { rejectionHandled: false, adoptedOut: false });
+      return id;
+    }, "wfRegisterRoot"),
+    wfMarkRejectionHandled: /* @__PURE__ */ __name((rootId) => {
+      const root = unconsumedRoots.get(rootId);
+      if (root) root.rejectionHandled = true;
+    }, "wfMarkRejectionHandled"),
+    wfIsRootHandled: /* @__PURE__ */ __name((rootId) => unconsumedRoots.get(rootId)?.rejectionHandled === true, "wfIsRootHandled"),
+    wfMarkAdopted: /* @__PURE__ */ __name((rootId) => {
+      const root = unconsumedRoots.get(rootId);
+      if (root) root.adoptedOut = true;
+    }, "wfMarkAdopted"),
+    runId: opts.runId ?? "",
+    wfReportUnconsumed: /* @__PURE__ */ __name((rootId, isRoot, dispatchFailed, msg) => {
+      if (unconsumedSettled) {
+        const rec = {
+          rootId,
+          isRoot,
+          dispatchFailed,
+          msg
+        };
+        const rootState = unconsumedRoots.get(rootId);
+        if (!rootState?.rejectionHandled && !(dispatchFailed && rootState?.adoptedOut)) {
+          safeLog(unconsumedRejectionLine(rec));
+        }
+        return 0;
+      }
+      const id = nextUnconsumedId++;
+      unconsumedRejections.set(id, { rootId, isRoot, dispatchFailed, msg });
+      return id;
+    }, "wfReportUnconsumed"),
+    wfClearUnconsumed: /* @__PURE__ */ __name((id) => {
+      unconsumedRejections.delete(id);
+    }, "wfClearUnconsumed"),
+    // R10-1: teardown discrimination cannot key on the error name alone.
+    // The dominant in-flight cancellation path (controller.abort() →
+    // subagent returns terminateMode=CANCELLED → runSingleDispatch throws
+    // a PLAIN Error) never produces an 'AbortError', so the mirror would
+    // log a spurious dispatch failure for a correctly-cancelled run. Once
+    // the run's abort signal has fired, the run is already settling as
+    // cancelled / timed-out — every rejection still crossing the boundary
+    // is teardown noise regardless of its shape.
+    isRunAborted: /* @__PURE__ */ __name(() => opts.abortOnTimeout?.signal.aborted === true, "isRunAborted"),
+    // The truthy flags distinguish "injected" from "default stub" inside the
+    // init script without leaking the host function itself when not used.
+    hasParallel: !!opts.parallel,
+    hasPipeline: !!opts.pipeline,
+    hasWorkflow: !!opts.workflow,
+    hasBudget: !!opts.budget,
+    hostParallel: opts.parallel,
+    hostPipeline: opts.pipeline,
+    hostWorkflow: opts.workflow,
+    budgetTotal: opts.budget ? opts.budget.total : null,
+    hostBudgetSpent: opts.budget ? opts.budget.spent.bind(opts.budget) : null,
+    hostBudgetRemaining: opts.budget ? opts.budget.remaining.bind(opts.budget) : null
+  };
+  Object.setPrototypeOf(bridge, null);
+  const sandboxGlobals = Object.assign(
+    /* @__PURE__ */ Object.create(null),
+    { __workflowBridge: bridge }
+  );
+  const ctx = vm.createContext(sandboxGlobals);
+  vm.runInContext(
+    `(() => {
+      const __b = globalThis.__workflowBridge;
+      delete globalThis.__workflowBridge;
+
+      // --- Math (vm-realm, random throws) ---
+      const realMath = Math;
+      const safeMath = Object.create(null);
+      for (const k of Object.getOwnPropertyNames(realMath)) {
+        if (k === 'random' || k === 'constructor') continue;
+        safeMath[k] = realMath[k];
+      }
+      safeMath.random = () => {
+        throw new Error(
+          'Math.random() is unavailable in workflow scripts (breaks resume). ' +
+          'For N independent samples, include the index in the agent label or prompt.'
+        );
+      };
+      globalThis.Math = safeMath;
+
+      // --- Date (vm-realm function that throws on any access) ---
+      const dateMsg = 'Date.now() / new Date() are unavailable in workflow ' +
+        'scripts (breaks resume). Stamp results after the workflow returns, ' +
+        'or pass timestamps via args.';
+      const safeDate = function Date() { throw new Error(dateMsg); };
+      safeDate.now = () => { throw new Error(dateMsg); };
+      safeDate.UTC = () => { throw new Error(dateMsg); };
+      safeDate.parse = () => { throw new Error(dateMsg); };
+      Object.setPrototypeOf(safeDate, null);
+      Object.defineProperty(safeDate, 'constructor', {
+        value: undefined, writable: false, configurable: false,
+      });
+      globalThis.Date = safeDate;
+
+      // --- args (parsed via vm-realm JSON \u2192 vm-realm objects/arrays) ---
+      // FIX-Round1-T2: vm-realm arrays keep their vm-realm Array.prototype,
+      // so for...of, .map, .forEach, spread, destructuring all work \u2014 and
+      // their inherited methods' constructors are vm-realm Function, which
+      // cannot reach host process.
+      globalThis.args = __b.argsJson === null ? undefined : JSON.parse(__b.argsJson);
+
+      // --- Wrap a host async function so it returns a vm-realm Promise ---
+      // FIX-Round1-T1/T8/T14: success and failure both cross the boundary
+      // as vm-realm values: resolve with the host's value (a primitive
+      // string for dispatch; vm-realm arrays for parallel/pipeline because
+      // those wrappers will produce vm-realm results); reject with a
+      // freshly-constructed vm-realm Error so e.constructor.constructor
+      // stays in the vm realm.
+      // Dispatch promises are ObservedPromise instances (a vm-realm
+      // Promise subclass). Its then override marks the result consumed
+      // and re-attaches the teardown observer to the derived promise, so
+      // script-derived chains (agent(...).then(...), await, and the
+      // ELEMENTS of static-combinator aggregates \u2014 everything that
+      // funnels through then) stay observed at every depth. The
+      // AGGREGATES of Promise.all/race/any are built by the native
+      // statics and never pass through the observed then, so those
+      // statics are wrapped explicitly below (observeAggregate).
+      // Without this, a correctly-cancelled run holding a pending derived
+      // chain fired a process-level unhandledRejection even though the
+      // bare dispatch promise was observed.
+      //
+      // Unconsumed rejections of an observed node are recorded through
+      // the bridge and mirrored into the run log at run settlement (a
+      // later consumption clears the record first) \u2014 a dispatch refused
+      // at the entry gate (budget / agent cap) or failing mid-run reaches
+      // no other surface, so without the mirror the failure leaves no
+      // log, alarm, or telemetry.
+      function mapDispatchError(hostErr) {
+        var msg;
+        try {
+          msg = (hostErr && hostErr.message != null)
+            ? String(hostErr.message)
+            : String(hostErr);
+        } catch (e) {
+          msg = '[unserializable rejection value]';
+        }
+        const vmErr = new Error(msg);
+        // Teardown discrimination at the host boundary \u2014 before the error
+        // is flattened into a vm-realm Error. Two shapes count as
+        // teardown: an error NAMED 'AbortError' (the scheduler's
+        // abortError() DOMException), and ANY rejection that crosses
+        // after the run's abort signal has fired \u2014 the dominant
+        // cancellation path rejects with a plain Error ('did not complete
+        // (terminate mode: CANCELLED).'), which a name-only match would
+        // mirror as a spurious dispatch failure on a correctly-cancelled
+        // run. Matching the name here (rather than the message text)
+        // still suppresses teardown noise without swallowing genuine
+        // failures whose message merely contains 'aborted' (e.g. a
+        // network-layer 'connection aborted by peer').
+        var isAbort = false;
+        try {
+          isAbort = !!(hostErr && hostErr.name === 'AbortError');
+        } catch (e) {
+          isAbort = false;
+        }
+        if (isAbort || __b.isRunAborted()) vmErr.__wfAbort = true;
+        vmErr.__wfDispatchFailed = true;
+        return vmErr;
+      }
+      function readFlag(value, name) {
+        try {
+          return !!(value && value[name]);
+        } catch (e) {
+          return false;
+        }
+      }
+      function observeDispatch(promise) {
+        // Direct native-then call: routing through ObservedPromise.then
+        // would mark the promise consumed and recurse the observer. The
+        // observer body must be exception-safe on ANY rejection value:
+        // a script handler can throw an exotic value (a message getter
+        // that throws, a Proxy with throwing traps), and an observer
+        // killed mid-body would turn the very rejection it watches into
+        // a process-level unhandledRejection \u2014 the exact failure class
+        // the observer exists to remove.
+        Promise.prototype.then.call(promise, undefined, function (err) {
+          if (promise.__wfConsumed) return;
+          // R11-30: also suppress on the run-level abort state, not just
+          // the rejection's own marker \u2014 a wrapped Promise.any aggregate
+          // rejects with a natively built AggregateError that carries
+          // neither marker, so teardown rejections of a correctly-
+          // cancelled run would still be mirrored when it is unconsumed.
+          if (readFlag(err, '__wfAbort') || __b.isRunAborted()) return;
+          var dispatchFailed = readFlag(err, '__wfDispatchFailed');
+          var errors = null;
+          try {
+            if (err && Array.isArray(err.errors)) errors = err.errors;
+          } catch (e) {
+            errors = null;
+          }
+          if (!dispatchFailed && errors) {
+            // R11-4: Promise.any rejects with a fresh vm-realm
+            // AggregateError carrying no flags; the element errors are
+            // reachable on .errors with their markers preserved. Derive
+            // the attribution from the causes instead of blaming the
+            // script for a dispatch failure.
+            for (var i = 0; i < errors.length; i++) {
+              if (readFlag(errors[i], '__wfDispatchFailed')) {
+                dispatchFailed = true;
+                break;
+              }
+            }
+          }
+          // R11-15: cross-root suppression \u2014 aggregate roots track
+          // rejectionHandled independently of their elements' roots, so
+          // a forwarded dispatch failure whose originating element root
+          // the script already handled must not mirror from the
+          // aggregate. The element rootId is stamped in vmAsync;
+          // Promise.all/race forward the element's own reason,
+          // Promise.any surfaces them on .errors.
+          try {
+            var sourceIds = [];
+            if (err && err.__wfRootId) {
+              sourceIds.push(err.__wfRootId);
+            } else if (errors) {
+              for (var j = 0; j < errors.length; j++) {
+                if (errors[j] && errors[j].__wfRootId) {
+                  sourceIds.push(errors[j].__wfRootId);
+                }
+              }
+            }
+            for (var k = 0; k < sourceIds.length; k++) {
+              if (
+                sourceIds[k] !== promise.__wfRootId &&
+                __b.wfIsRootHandled(sourceIds[k])
+              ) {
+                return;
+              }
+            }
+          } catch (e) {
+            // A throwing exotic value must not kill the observer; fall
+            // through and mirror conservatively.
+          }
+          var msg;
+          try {
+            msg = String(err && err.message != null ? err.message : err);
+          } catch (e) {
+            msg = '[unserializable rejection value]';
+          }
+          promise.__wfUnconsumedId = __b.wfReportUnconsumed(
+            promise.__wfRootId,
+            promise.__wfIsRoot === true,
+            dispatchFailed,
+            msg,
+          );
+        });
+      }
+      // R11-3: await / Promise.resolve / returning a thenable from a
+      // handler adopts an ObservedPromise through this then with the
+      // adopting promise's capability (resolve, reject) pair \u2014 native
+      // functions, indistinguishable from real handlers by arity. They
+      // are detected by the native toString signature. Adoption
+      // CONSUMES the result (a delayed adoption clears a recorded
+      // verdict exactly like a delayed await) but is NOT a rejection
+      // handler: the rejection transfers into the adopting promise \u2014
+      // typically an async wrapper's implicit promise, which is a plain
+      // vm-realm Promise the mirror cannot observe. Marking adoption as
+      // handling would silently disarm the mirror for the forgotten-
+      // await failure class; the run-level escape hook in the host
+      // surfaces those escapes instead. Bound script functions also
+      // stringify as native code; misreading one as adoption only
+      // forgoes the rejectionHandled marking, never native semantics.
+      function isAdoptionAttach(handler) {
+        try {
+          return (
+            typeof handler === 'function' &&
+            Function.prototype.toString
+              .call(handler)
+              .indexOf('[native code]') !== -1
+          );
+        } catch (e) {
+          return false;
+        }
+      }
+      class ObservedPromise extends Promise {
+        then(onFulfilled, onRejected) {
+          // R11-26: introspect the handler BEFORE any state mutation.
+          // The read is guarded because a script-supplied handler can
+          // be exotic (a revoked Proxy wrapping a function, a throwing
+          // accessor) \u2014 an unguarded read made .then() throw
+          // synchronously, something native then never does, leaving
+          // the promise marked consumed with no handler attached.
+          var rethrows = false;
+          try {
+            rethrows = !!(onRejected && onRejected.__wfRethrows);
+          } catch (e) {
+            rethrows = false;
+          }
+          this.__wfConsumed = true;
+          // An attached rejection handler means the script can surface the
+          // root rejection itself; the mirror stays silent for it. The
+          // finally override below routes through this then with marked
+          // rethrow combinators \u2014 those re-raise the rejection instead of
+          // handling it, so they must NOT set the flag (marking them
+          // handled would silently drop a fire-and-forget
+          // agent(...).finally(...) failure). Adoption attaches count
+          // as consumption only, never handling (see isAdoptionAttach):
+          // they mark adoptedOut so forwarded sibling entries defer to
+          // the adopting chain / escape hook instead of mirroring.
+          if (isAdoptionAttach(onRejected)) {
+            __b.wfMarkAdopted(this.__wfRootId);
+          } else if (typeof onRejected === 'function' && !rethrows) {
+            __b.wfMarkRejectionHandled(this.__wfRootId);
+          }
+          // A delayed consumption clears a verdict recorded at
+          // rejection-settlement time, so a late-but-real await is not
+          // misreported as unconsumed.
+          if (this.__wfUnconsumedId !== undefined) {
+            __b.wfClearUnconsumed(this.__wfUnconsumedId);
+            this.__wfUnconsumedId = undefined;
+          }
+          const derived = super.then(onFulfilled, onRejected);
+          derived.__wfRootId = this.__wfRootId;
+          observeDispatch(derived);
+          return derived;
+        }
+        finally(onFinally) {
+          // Native Promise.prototype.finally calls the observed then with
+          // two function combinators, indistinguishable there from a real
+          // then(f, g) \u2014 which would mark the root rejection handled even
+          // though finally rethrows it. Implement finally through the
+          // observed then with an explicitly-marked rethrow combinator so
+          // the mirror stays armed for finally-only chains.
+          if (typeof onFinally !== 'function') {
+            return this.then(undefined, undefined);
+          }
+          const onRethrow = function (err) {
+            return Promise.resolve(onFinally()).then(function () {
+              throw err;
+            });
+          };
+          onRethrow.__wfRethrows = true;
+          return this.then(
+            function (value) {
+              return Promise.resolve(onFinally()).then(function () {
+                return value;
+              });
+            },
+            onRethrow,
+          );
+        }
+      }
+      // --- Static combinators: observe the aggregate promise ---
+      // Promise.all/race/any build their aggregate via the native static;
+      // it never passes through the observed then, so a fire-and-forget
+      // aggregate holding a failed dispatch would escape the run-log
+      // mirror. While the run is live the host's adoption-escape hook
+      // (R11-3) still catches and mirrors the process-level
+      // unhandledRejection \u2014 a round-14 A/B confirmed that hook, not
+      // this wrap, is the live-run backstop \u2014 but only with the coarse
+      // '(rejection not handled)' wording, and once the run's hook is
+      // detached nothing in the sandbox catches the escape. R14-A:
+      // wrapping the statics gives each aggregate its own observer, so
+      // consumption tracking works through the aggregate's own observed
+      // then (await / .catch / .then marks it handled) and the mirror
+      // itself classifies the rejection; the elements still funnel
+      // through the then override via the native static's internal
+      // attach, so they stay marked consumed.
+      function observeAggregate(nativeAggregate) {
+        const rootId = __b.wfRegisterRoot();
+        const observed = new ObservedPromise(function (resolve, reject) {
+          Promise.prototype.then.call(nativeAggregate, resolve, reject);
+        });
+        observed.__wfRootId = rootId;
+        observed.__wfIsRoot = true;
+        observeDispatch(observed);
+        return observed;
+      }
+      const nativePromiseAll = Promise.all;
+      const nativePromiseRace = Promise.race;
+      const nativePromiseAny = Promise.any;
+      // R11-16: a static called on a script-defined Promise subclass
+      // must honor the species contract and return a subclass instance,
+      // so non-default receivers bypass observation (their elements
+      // still funnel through the observed then, and a fire-and-forget
+      // dispatch failure escaping such an aggregate is still caught by
+      // the host's adoption-escape hook via its stamped markers).
+      Promise.all = function (items) {
+        if (this !== Promise) return nativePromiseAll.call(this, items);
+        return observeAggregate(nativePromiseAll.call(this, items));
+      };
+      Promise.race = function (items) {
+        if (this !== Promise) return nativePromiseRace.call(this, items);
+        return observeAggregate(nativePromiseRace.call(this, items));
+      };
+      Promise.any = function (items) {
+        if (this !== Promise) return nativePromiseAny.call(this, items);
+        return observeAggregate(nativePromiseAny.call(this, items));
+      };
+      function vmAsync(hostFn) {
+        return function (...vmArgs) {
+          const rootId = __b.wfRegisterRoot();
+          const p = new ObservedPromise(function (resolve, reject) {
+            function rejectMapped(hostErr) {
+              const vmErr = mapDispatchError(hostErr);
+              // Stamp the originating root and run BEFORE the error can
+              // be forwarded into aggregate promises: the observer's
+              // cross-root suppression (R11-15) reads __wfRootId and
+              // the host's adoption-escape hook (R11-3) attributes by
+              // __wfRunId.
+              try {
+                vmErr.__wfRootId = rootId;
+                vmErr.__wfRunId = __b.runId;
+              } catch (e) {}
+              reject(vmErr);
+            }
+            try {
+              const hostPromise = hostFn.apply(null, vmArgs);
+              hostPromise.then(
+                function (value) { resolve(value); },
+                rejectMapped
+              );
+            } catch (hostErr) {
+              rejectMapped(hostErr);
+            }
+          });
+          p.__wfRootId = rootId;
+          p.__wfIsRoot = true;
+          observeDispatch(p);
+          return p;
+        };
+      }
+
+      // --- phase / log ---
+      globalThis.phase = function phase(title) {
+        __b.pushPhase(String(title));
+      };
+      globalThis.log = function log(msg) {
+        __b.pushLog(msg);
+      };
+
+      // --- console (object with hardened methods, all in vm-realm) ---
+      const safeConsole = Object.create(null);
+      safeConsole.log = function () {
+        const parts = [];
+        for (let i = 0; i < arguments.length; i++) parts.push(String(arguments[i]));
+        __b.pushLog(parts.join(' '));
+      };
+      safeConsole.warn = safeConsole.log;
+      safeConsole.error = safeConsole.log;
+      globalThis.console = safeConsole;
+
+      // --- agent (with runtime allowlist + named throws, all vm-realm) ---
+      // FIX-Round1-T13: throw on any opts key not in the allowlist \u2014 catches
+      // typos like { scema: ... } that previously slipped through the
+      // [key:string]: unknown index signature.
+      const KNOWN_AGENT_OPTS = ['label', 'phase', 'schema', 'model', 'isolation', 'agentType', 'stallMs', 'workingDir'];
+      globalThis.agent = vmAsync(function (prompt, agentOpts) {
+        agentOpts = agentOpts || {};
+        const keys = Object.keys(agentOpts);
+        for (let i = 0; i < keys.length; i++) {
+          const k = keys[i];
+          if (KNOWN_AGENT_OPTS.indexOf(k) === -1) {
+            throw new Error(
+              "agent({" + k + "}): unknown option. " +
+              "Known options are: " + KNOWN_AGENT_OPTS.join(', ') + "."
+            );
+          }
+        }
+        // P3: schema + model + agentType + isolation are all wired through
+        // createProductionDispatch \u2192 SubagentManager.createAgentHeadless.
+        // The dispatch surfaces descriptive errors for "agent type not found",
+        // "isolation:'remote' is not available in this build", parent-dirty
+        // refuse, worktree creation failures, and StructuredOutput contract
+        // violations ("completed without calling StructuredOutput after 2
+        // in-conversation nudges").
+        if (
+          agentOpts.isolation !== undefined &&
+          agentOpts.isolation !== 'worktree' &&
+          agentOpts.isolation !== 'remote'
+        ) {
+          throw new Error(
+            "agent({isolation: '" + agentOpts.isolation + "'}): unknown isolation mode. " +
+            "Known modes are: 'worktree', 'remote'."
+          );
+        }
+        // NOTE: this init script is a host-side template literal \u2014 no
+        // backticks anywhere below, in code or comments.
+        //
+        // A non-number stallMs is silently dropped downstream and the
+        // default watchdog applies, contradicting "0 disables the watchdog"
+        // \u2014 refuse it loudly like the other option gates.
+        if (agentOpts.stallMs !== undefined && (typeof agentOpts.stallMs !== 'number' || !Number.isFinite(agentOpts.stallMs))) {
+          throw new Error("agent({stallMs}): must be a finite number of milliseconds (0 disables the watchdog).");
+        }
+        // workingDir pins the agent to a worktree the CALLER already owns;
+        // isolation creates and reaps one. Asking for both is a contradiction
+        // about who owns the directory's lifetime, so name it here rather than
+        // silently letting one win.
+        if (agentOpts.workingDir !== undefined) {
+          if (typeof agentOpts.workingDir !== 'string' || agentOpts.workingDir.trim().length === 0) {
+            throw new Error(
+              "agent({workingDir}): must be a non-empty string naming an existing " +
+              "git worktree of this repository."
+            );
+          }
+          if (agentOpts.isolation !== undefined) {
+            throw new Error(
+              "agent({workingDir, isolation}): incompatible options. workingDir " +
+              "pins the agent to a worktree you already own; isolation creates " +
+              "a fresh one and removes it afterwards. Pass one."
+            );
+          }
+        }
+        if (typeof agentOpts.phase === 'string' && agentOpts.phase.length > 0) {
+          if (__b.lastPhase() !== agentOpts.phase) {
+            __b.pushPhase(agentOpts.phase);
+          }
+        }
+        // SECURITY (P3 R2 self-review): user-script-controlled agentOpts
+        // cross the vm/host boundary verbatim via vmAsync's hostFn.apply.
+        // A Proxy / inherited-getter / non-plain object in agentOpts.schema
+        // would let host-side code (SyntheticOutputTool constructor + AJV
+        // compile) trigger user-controlled trap handlers that execute with
+        // the host realm's full surface. Revive agentOpts through JSON
+        // round-trip BEFORE crossing so the host only ever sees vm-realm
+        // plain objects with vm-realm prototypes. Same mechanism that
+        // makes args + parallel/pipeline results safe.
+        var safeOpts;
+        try {
+          safeOpts = JSON.parse(JSON.stringify(agentOpts));
+        } catch (e) {
+          throw new Error(
+            "agent() opts contain a non-JSON-serializable value: " +
+            String(e && e.message != null ? e.message : e)
+          );
+        }
+        // SECURITY (PR #4947 R1 wenshao, extended for P3): vmAsync's resolve
+        // path is verbatim (no re-wrap of resolved values). Host-realm
+        // strings cross the boundary harmlessly because primitives have no
+        // prototype identity. But P3's schema-mode dispatch returns the
+        // validated structured_output args as a host-realm OBJECT --
+        // handing that to the script reopens the T1/T8/T14 escape:
+        // result.constructor.constructor("return process")() would walk
+        // the host Object.prototype chain to the host Function
+        // constructor. Per-call JSON revival inside this vm runInContext
+        // block makes the returned object carry vm-realm prototypes (same
+        // mechanism as parallel/pipeline reviveInRealm and the args
+        // global revival). The fallback to null on a non-serializable
+        // resolve mirrors the errors-as-data convention parallel/pipeline
+        // already use for individual slot failures.
+        // R3 review (wenshao T3 [Suggestion]): the null fallback below is
+        // a SECURITY backstop, not a contract path. In schema mode the
+        // host return is the validated args of a structured_output tool
+        // call -- LLM tool_call payloads are always JSON-serializable
+        // (the model sends them through the OpenAI tool-call protocol
+        // which serializes through JSON itself) and SyntheticOutputTool's
+        // AJV validation runs over the parsed JSON, so a non-serializable
+        // host return is unreachable in production schema mode. The
+        // sentinel preserves the errors-as-data convention parallel /
+        // pipeline already use for individual slot failures, and stays as
+        // residual defense for any future dispatch path whose return
+        // value isn't a tool_call payload. logRevivalFailure surfaces
+        // the actionable detail (slot 0 + the error string) to operators
+        // so a real trigger in production isn't silent.
+        return __b.hostAgent(prompt, safeOpts).then(function (value) {
+          if (value === null || typeof value !== 'object') {
+            return value;
+          }
+          try {
+            return JSON.parse(JSON.stringify(value));
+          } catch (e) {
+            __b.logRevivalFailure(0, String(e && e.message != null ? e.message : e));
+            return null;
+          }
+        });
+      });
+
+      // --- parallel / pipeline ---
+      // SECURITY (PR #4732 P2): the host impl resolves with a HOST-realm array.
+      // vmAsync's resolve path is verbatim (it does NOT re-wrap resolved
+      // values), so handing that host array to the script would reopen the
+      // T1/T8/T14 escape: result.constructor.constructor('return process')()
+      // walks the host Array.prototype chain to the host Function constructor.
+      // We revive the array INSIDE the vm realm with JSON.parse(JSON.stringify)
+      // -- the same mechanism that makes the args global safe (see the args
+      // revival above) -- so the value the script sees has vm-realm prototypes
+      // whose constructors can't reach host process. Agent results are JSON
+      // strings (and null slots), so the round-trip is lossless for P2.
+      //
+      // EAD-1 (P2 self-review): revive PER-ELEMENT, not the whole array in one
+      // JSON.stringify. A single slot whose VALUE is non-serializable (a thunk
+      // that returns a BigInt or a circular object) must become null at its
+      // index -- it must NOT throw on the whole array and destroy every sibling
+      // result, which would defeat errors-as-data for return values. The outer
+      // [] is built in-realm here, so the result keeps vm-realm prototypes.
+      //
+      // SECURITY (PR #4947 R1 wenshao): reviveInRealm MUST remain inside this
+      // vm init runInContext block. JSON, Array, Object here are vm-realm
+      // globals; extracting this function to a host-side utility (e.g. a
+      // shared utils/jsonRevive.ts) would resolve those references against
+      // the HOST realm, silently reopening the T1/T8/T14 escape that the
+      // revival is designed to prevent. The textual identity to a host-side
+      // util is exactly the trap.
+      function reviveInRealm(hostArr) {
+        const out = [];
+        for (let i = 0; i < hostArr.length; i++) {
+          try {
+            out[i] = JSON.parse(JSON.stringify(hostArr[i]));
+          } catch (e) {
+            // Cross to host realm for debug logging. The bridge function
+            // accepts only primitive strings/numbers; the error message is
+            // coerced to a String here so no vm-realm Error object crosses.
+            __b.logRevivalFailure(i, String(e?.message ?? e));
+            out[i] = null;
+          }
+        }
+        return out;
+      }
+      if (__b.hasParallel) {
+        const callParallel = vmAsync(function (thunks) {
+          return __b.hostParallel(thunks);
+        });
+        globalThis.parallel = function parallel(thunks) {
+          return callParallel(thunks).then(reviveInRealm);
+        };
+      } else {
+        globalThis.parallel = function parallel() {
+          return new Promise(function (_, reject) {
+            reject(new Error(
+              'parallel() is unavailable: this sandbox was created without a ' +
+              'parallel implementation. The orchestrator injects one; a bare ' +
+              'sandbox has no concurrent-dispatch capability.'
+            ));
+          });
+        };
+      }
+      if (__b.hasPipeline) {
+        const callPipeline = vmAsync(function (items) {
+          const stages = [];
+          for (let i = 1; i < arguments.length; i++) stages.push(arguments[i]);
+          return __b.hostPipeline.apply(null, [items].concat(stages));
+        });
+        globalThis.pipeline = function pipeline() {
+          return callPipeline.apply(null, arguments).then(reviveInRealm);
+        };
+      } else {
+        globalThis.pipeline = function pipeline() {
+          return new Promise(function (_, reject) {
+            reject(new Error(
+              'pipeline() is unavailable: this sandbox was created without a ' +
+              'pipeline implementation. The orchestrator injects one; a bare ' +
+              'sandbox has no staggered multi-stage capability.'
+            ));
+          });
+        };
+      }
+      // --- workflow (nested, single-level) ---
+      // Mirrors agent(): args cross vm\u2192host verbatim (safe direction), the
+      // single result is revived back into the vm realm via JSON round-trip
+      // (same T1/T8/T14 escape defense as agent / parallel / pipeline). The
+      // host impl resolves a saved workflow and runs it sharing this run's
+      // agent-count cap + token budget. When __b.hasWorkflow is false, the
+      // sandbox is either bare (no resolver wired) OR is itself a nested
+      // workflow \u2014 in both cases workflow() must throw, which is how the
+      // single-level nesting limit is enforced (a nested sandbox is created
+      // without a workflow impl, so its workflow() lands in the else branch).
+      if (__b.hasWorkflow) {
+        const callWorkflow = vmAsync(function (nameOrRef, wfArgs) {
+          // Sanitize args through a JSON round-trip BEFORE crossing so the
+          // host only ever sees vm-realm plain objects (same defense as
+          // agent()'s safeOpts). nameOrRef may be a string or {scriptPath}.
+          var safeRef;
+          var safeArgs;
+          try {
+            safeRef = nameOrRef === undefined
+              ? undefined
+              : JSON.parse(JSON.stringify(nameOrRef));
+            safeArgs = wfArgs === undefined
+              ? undefined
+              : JSON.parse(JSON.stringify(wfArgs));
+          } catch (e) {
+            throw new Error(
+              'workflow() received a non-JSON-serializable argument: ' +
+              String(e && e.message != null ? e.message : e)
+            );
+          }
+          return __b.hostWorkflow(safeRef, safeArgs).then(function (value) {
+            if (value === null || typeof value !== 'object') {
+              return value;
+            }
+            try {
+              return JSON.parse(JSON.stringify(value));
+            } catch (e) {
+              __b.logRevivalFailure(0, String(e && e.message != null ? e.message : e));
+              return null;
+            }
+          });
+        });
+        globalThis.workflow = function workflow(nameOrRef, wfArgs) {
+          return callWorkflow(nameOrRef, wfArgs);
+        };
+      } else {
+        globalThis.workflow = function workflow() {
+          return new Promise(function (_, reject) {
+            reject(new Error(
+              "workflow() is unavailable here. Either this sandbox was created " +
+              "without a saved-workflow resolver, or this script is already " +
+              "running as a nested workflow \u2014 workflow() nesting is limited to " +
+              "a single level (a workflow cannot call another workflow that " +
+              "itself calls workflow())."
+            ));
+          });
+        };
+      }
+
+      // --- budget ---
+      const safeBudget = Object.create(null);
+      Object.defineProperty(safeBudget, 'total', {
+        value: __b.budgetTotal,
+        writable: false, configurable: false,
+      });
+      if (__b.hasBudget) {
+        Object.defineProperty(safeBudget, 'spent', {
+          value: function spent() { return __b.hostBudgetSpent(); },
+          writable: false, configurable: false,
+        });
+        Object.defineProperty(safeBudget, 'remaining', {
+          value: function remaining() { return __b.hostBudgetRemaining(); },
+          writable: false, configurable: false,
+        });
+      } else {
+        Object.defineProperty(safeBudget, 'spent', {
+          value: function spent() {
+            throw new Error(
+              'budget.spent() is not supported in P1. Token tracking is scheduled for P5.'
+            );
+          },
+          writable: false, configurable: false,
+        });
+        Object.defineProperty(safeBudget, 'remaining', {
+          value: function remaining() {
+            throw new Error(
+              'budget.remaining() is not supported in P1. Token tracking is scheduled for P5.'
+            );
+          },
+          writable: false, configurable: false,
+        });
+      }
+      globalThis.budget = safeBudget;
+    })();`,
+    ctx,
+    { filename: "workflow-sandbox-init.js" }
+  );
+  const maxWallClockMs = resolveMaxWallClockMs(opts);
+  const flushUnconsumedRejections = /* @__PURE__ */ __name(async () => {
+    unconsumedSettled = true;
+    if (nextUnconsumedId === 1) return;
+    await new Promise((resolve2) => {
+      setImmediate(resolve2);
+    });
+    for (const rec of unconsumedRejections.values()) {
+      const rootState = unconsumedRoots.get(rec.rootId);
+      if (rootState?.rejectionHandled) {
+        continue;
+      }
+      if (rec.dispatchFailed && rootState?.adoptedOut) {
+        continue;
+      }
+      const key = rec.rootId + "\0" + rec.msg;
+      if (mirroredEscapeKeys.has(key)) continue;
+      mirroredEscapeKeys.add(key);
+      safeLog(unconsumedRejectionLine(rec));
+    }
+    unconsumedRejections.clear();
+  }, "flushUnconsumedRejections");
+  const hookRunId = opts.runId ?? "";
+  const adoptionEscapeHook = /* @__PURE__ */ __name((reason, _promise) => {
+    try {
+      if (!reason || typeof reason !== "object") return;
+      const marked = reason;
+      if (marked.__wfDispatchFailed !== true) return;
+      if (String(marked.__wfRunId ?? "") !== hookRunId) return;
+      const rootId = typeof marked.__wfRootId === "number" ? marked.__wfRootId : void 0;
+      if (rootId !== void 0 && unconsumedRoots.get(rootId)?.rejectionHandled) {
+        return;
+      }
+      let msg;
+      try {
+        msg = marked.message != null ? String(marked.message) : String(reason);
+      } catch {
+        msg = "[unserializable rejection value]";
+      }
+      const key = String(rootId ?? "") + "\0" + msg;
+      if (mirroredEscapeKeys.has(key)) return;
+      mirroredEscapeKeys.add(key);
+      safeLog("dispatch failed (rejection not handled): " + msg);
+    } catch (e) {
+      debugLogger.warn("adoptionEscapeHook failed:", e);
+    }
+  }, "adoptionEscapeHook");
+  let extractedMeta = null;
+  return {
+    async run(scriptSource) {
+      unconsumedSettled = false;
+      unconsumedRoots.clear();
+      unconsumedRejections.clear();
+      nextUnconsumedId = 1;
+      mirroredEscapeKeys = /* @__PURE__ */ new Set();
+      let watchdog;
+      let stopWatchingState;
+      let rearmWatchdogOnAbort;
+      let settleOnAbort;
+      let wallClockFired = false;
+      process.on("unhandledRejection", adoptionEscapeHook);
+      try {
+        const { script, meta } = compileWorkflowScript(scriptSource);
+        extractedMeta = meta;
+        if (opts.abortOnTimeout?.signal.aborted) {
+          throw workflowCancelledError();
+        }
+        const runOpts = {
+          timeout: 3e4
+        };
+        const result = script.runInContext(ctx, runOpts);
+        const timeoutPromise = new Promise((_, reject) => {
+          watchdog = new WallClockWatchdog(maxWallClockMs, () => {
+            wallClockFired = true;
+            opts.abortOnTimeout?.abort();
+            reject(
+              new Error(
+                `Workflow execution exceeded ${maxWallClockMs} ms of active time (paused time is not counted). Override via SandboxOptions.maxWallClockMs or QWEN_CODE_MAX_WORKFLOW_SECONDS env var.`
+              )
+            );
+          });
+        });
+        const aborted = /* @__PURE__ */ __name(() => opts.abortOnTimeout?.signal.aborted === true, "aborted");
+        stopWatchingState = opts.scheduler?.onStateChange(({ state }) => {
+          if (state === "paused" && !aborted()) watchdog?.pause();
+          else watchdog?.resume();
+        });
+        if (opts.scheduler?.snapshot().state === "paused" && !aborted()) {
+          watchdog?.pause();
+        }
+        rearmWatchdogOnAbort = /* @__PURE__ */ __name(() => watchdog?.resume(), "rearmWatchdogOnAbort");
+        opts.abortOnTimeout?.signal.addEventListener(
+          "abort",
+          rearmWatchdogOnAbort,
+          { once: true }
+        );
+        const abortPromise = new Promise((_, reject) => {
+          const signal = opts.abortOnTimeout?.signal;
+          if (!signal) return;
+          settleOnAbort = /* @__PURE__ */ __name(() => {
+            if (!wallClockFired) reject(workflowCancelledError());
+          }, "settleOnAbort");
+          signal.addEventListener("abort", settleOnAbort, { once: true });
+        });
+        return await Promise.race([result, timeoutPromise, abortPromise]);
+      } finally {
+        if (rearmWatchdogOnAbort) {
+          opts.abortOnTimeout?.signal.removeEventListener(
+            "abort",
+            rearmWatchdogOnAbort
+          );
+        }
+        if (settleOnAbort) {
+          opts.abortOnTimeout?.signal.removeEventListener(
+            "abort",
+            settleOnAbort
+          );
+        }
+        stopWatchingState?.();
+        watchdog?.stop();
+        await flushUnconsumedRejections();
+        process.off("unhandledRejection", adoptionEscapeHook);
+      }
+    },
+    getPhases: /* @__PURE__ */ __name(() => [...phases], "getPhases"),
+    getLogs: /* @__PURE__ */ __name(() => [...logs], "getLogs"),
+    appendLog: /* @__PURE__ */ __name((line) => safeLog(line, false), "appendLog"),
+    getMeta: /* @__PURE__ */ __name(() => extractedMeta, "getMeta")
+  };
+}
+__name(createWorkflowSandbox, "createWorkflowSandbox");
+
+// packages/core/src/agents/runtime/workflow-saved.ts
+init_esbuild_shims();
+import { promises as fs } from "node:fs";
+import * as path from "node:path";
+var debugLogger2 = createDebugLogger("WORKFLOW_SAVED");
+var WORKFLOW_NAME_PATTERN = /^[a-z][a-z0-9-]{0,40}$/;
+function validateWorkflowName(name) {
+  if (!name) return "Workflow name is required.";
+  if (!WORKFLOW_NAME_PATTERN.test(name)) {
+    return `Invalid workflow name "${name}". Use lower-case letters, digits, and hyphens only (must start with a letter, max 41 chars).`;
+  }
+  return null;
+}
+__name(validateWorkflowName, "validateWorkflowName");
+function getSavedWorkflowDirs(config) {
+  return [
+    { dir: config.storage.getProjectWorkflowsDir(), source: "project" },
+    { dir: Storage.getUserWorkflowsDir(), source: "user" }
+  ];
+}
+__name(getSavedWorkflowDirs, "getSavedWorkflowDirs");
+function getWorkflowScriptRoots(config) {
+  return [
+    ...getSavedWorkflowDirs(config).map(({ dir }) => dir),
+    config.storage.getGeneratedWorkflowsDir()
+  ];
+}
+__name(getWorkflowScriptRoots, "getWorkflowScriptRoots");
+async function isSymlinkedRoot(dir) {
+  return fs.lstat(dir).then((st) => st.isSymbolicLink()).catch(() => false);
+}
+__name(isSymlinkedRoot, "isSymlinkedRoot");
+async function listJsFiles(dir) {
+  if (await isSymlinkedRoot(dir)) {
+    debugLogger2.warn(`refusing symlinked saved-workflow dir: ${dir}`);
+    return [];
+  }
+  try {
+    const names = await fs.readdir(dir);
+    const out = [];
+    for (const n of names) {
+      if (!n.endsWith(".js")) continue;
+      const st = await fs.lstat(path.join(dir, n)).catch(() => null);
+      if (!st || st.isSymbolicLink()) continue;
+      out.push(n);
+    }
+    return out;
+  } catch (e) {
+    const code = e?.code;
+    if (code !== "ENOENT") {
+      debugLogger2.warn(`listJsFiles failed for ${dir}: ${e}`);
+    }
+    return [];
+  }
+}
+__name(listJsFiles, "listJsFiles");
+async function readWorkflowFileSecurely(filePath, config) {
+  const real = await fs.realpath(filePath);
+  const roots = await Promise.all(
+    getWorkflowScriptRoots(config).map(async (dir) => {
+      if (await isSymlinkedRoot(dir)) return { dir, real: null };
+      try {
+        return { dir, real: await fs.realpath(dir) };
+      } catch {
+        return { dir, real: path.resolve(dir) };
+      }
+    })
+  );
+  const dirs = roots.flatMap((r) => r.real === null ? [] : [r.real]);
+  const inside = dirs.some((d) => real === d || real.startsWith(d + path.sep));
+  if (!inside) {
+    const refused = roots.flatMap((r) => r.real === null ? [r.dir] : []);
+    const refusedNote = refused.length > 0 ? `; refused symlinked ${refused.length === 1 ? "root" : "roots"}: ${refused.join(", ")}` : "";
+    throw new Error(
+      `refusing to load a workflow file outside the workflow script roots (checked: ${dirs.join(", ")}${refusedNote}): '${filePath}'.`
+    );
+  }
+  return fs.readFile(real, "utf8");
+}
+__name(readWorkflowFileSecurely, "readWorkflowFileSecurely");
+async function resolveSavedWorkflowNameForPath(scriptPath, config) {
+  const realScriptPath = await fs.realpath(scriptPath);
+  for (const { dir } of getSavedWorkflowDirs(config)) {
+    if (await isSymlinkedRoot(dir)) continue;
+    let realDir;
+    try {
+      realDir = await fs.realpath(dir);
+    } catch {
+      continue;
+    }
+    if (realScriptPath !== realDir && !realScriptPath.startsWith(realDir + path.sep)) {
+      continue;
+    }
+    const name = path.basename(realScriptPath).replace(/\.js$/, "");
+    return WORKFLOW_NAME_PATTERN.test(name) ? name : void 0;
+  }
+  return void 0;
+}
+__name(resolveSavedWorkflowNameForPath, "resolveSavedWorkflowNameForPath");
+async function listSavedWorkflows(config) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const { dir, source } of [...getSavedWorkflowDirs(config)].reverse()) {
+    for (const file of await listJsFiles(dir)) {
+      const name = file.slice(0, -".js".length);
+      if (!WORKFLOW_NAME_PATTERN.test(name)) continue;
+      byName.set(name, { name, scriptPath: path.join(dir, file), source });
+    }
+  }
+  return Array.from(byName.values()).sort(
+    (a, b) => a.name.localeCompare(b.name)
+  );
+}
+__name(listSavedWorkflows, "listSavedWorkflows");
+async function resolveSavedWorkflowScript(nameOrRef, config) {
+  if (typeof nameOrRef === "object" && nameOrRef !== null) {
+    const scriptPath = nameOrRef.scriptPath;
+    if (typeof scriptPath !== "string" || scriptPath.length === 0) {
+      throw new Error(
+        "workflow() expects a workflow name (string) or {scriptPath: string}."
+      );
+    }
+    let script;
+    try {
+      script = await readWorkflowFileSecurely(scriptPath, config);
+    } catch (e) {
+      throw new Error(
+        `workflow({scriptPath: '${scriptPath}'}): ${e instanceof Error ? e.message : String(e)}`
+      );
+    }
+    const name2 = path.basename(scriptPath).replace(/\.js$/, "");
+    const savedWorkflowName = await resolveSavedWorkflowNameForPath(
+      scriptPath,
+      config
+    );
+    return {
+      name: name2,
+      scriptPath,
+      script,
+      ...savedWorkflowName ? { savedWorkflowName } : {}
+    };
+  }
+  if (typeof nameOrRef !== "string") {
+    throw new Error(
+      "workflow() expects a workflow name (string) or {scriptPath: string}."
+    );
+  }
+  const name = nameOrRef;
+  const nameError = validateWorkflowName(name);
+  if (nameError) {
+    throw new Error(`workflow('${name}'): ${nameError}`);
+  }
+  for (const { dir } of getSavedWorkflowDirs(config)) {
+    const scriptPath = path.join(dir, `${name}.js`);
+    try {
+      const script = await readWorkflowFileSecurely(scriptPath, config);
+      return { name, scriptPath, script, savedWorkflowName: name };
+    } catch {
+    }
+  }
+  const available = (await listSavedWorkflows(config)).map((e) => e.name);
+  throw new Error(
+    `workflow('${name}'): no workflow with that name. Available: ${available.length > 0 ? available.join(", ") : "(none)"}.`
+  );
+}
+__name(resolveSavedWorkflowScript, "resolveSavedWorkflowScript");
+async function saveWorkflowScript(config, opts) {
+  const { name, scope, script, overwrite = false } = opts;
+  const nameError = validateWorkflowName(name);
+  if (nameError) return { status: "invalid-name", error: nameError };
+  if (!script || script.trim().length === 0) {
+    return {
+      status: "empty-script",
+      error: "This run has no script source to save."
+    };
+  }
+  const dir = scope === "project" ? config.storage.getProjectWorkflowsDir() : Storage.getUserWorkflowsDir();
+  if (await isSymlinkedRoot(dir)) {
+    throw new Error(
+      `refusing to save into a symlinked saved-workflow directory: '${dir}'.`
+    );
+  }
+  const filePath = path.join(dir, `${name}.js`);
+  if (!overwrite) {
+    try {
+      await fs.access(filePath);
+      return { status: "exists", name, scope, path: filePath };
+    } catch {
+    }
+  }
+  await fs.mkdir(dir, { recursive: true });
+  await fs.writeFile(filePath, script, "utf8");
+  return { status: "saved", name, scope, path: filePath };
+}
+__name(saveWorkflowScript, "saveWorkflowScript");
+var INLINE_RUN_ID_PATTERN = /^wf_[0-9a-f]+$/;
+async function persistInlineWorkflowScript(config, runId, script) {
+  if (!INLINE_RUN_ID_PATTERN.test(runId)) {
+    debugLogger2.warn(`refusing to persist a script for run id: ${runId}`);
+    return null;
+  }
+  const storage = config.storage;
+  if (!storage) return null;
+  try {
+    const filePath = storage.getInlineWorkflowScriptPath(runId);
+    const dir = path.dirname(filePath);
+    if (await isSymlinkedRoot(storage.getGeneratedWorkflowsDir()) || await isSymlinkedRoot(dir)) {
+      debugLogger2.warn(
+        `refusing to persist an inline workflow script into a symlinked root: '${dir}'.`
+      );
+      return null;
+    }
+    await fs.mkdir(dir, { recursive: true });
+    await atomicWriteFile(filePath, script, {
+      encoding: "utf8",
+      mode: 384,
+      forceMode: true,
+      noFollow: true
+    });
+    return filePath;
+  } catch (error) {
+    debugLogger2.warn(
+      `failed to persist inline workflow script for ${runId}: ${error}`
+    );
+    return null;
+  }
+}
+__name(persistInlineWorkflowScript, "persistInlineWorkflowScript");
+async function deleteInlineWorkflowScript(config, runId) {
+  if (!INLINE_RUN_ID_PATTERN.test(runId)) return false;
+  const storage = config.storage;
+  if (!storage) return false;
+  try {
+    await fs.rm(storage.getInlineWorkflowScriptPath(runId), { force: true });
+    return true;
+  } catch (error) {
+    debugLogger2.warn(
+      `failed to delete inline workflow script for ${runId}: ${error}`
+    );
+    return false;
+  }
+}
+__name(deleteInlineWorkflowScript, "deleteInlineWorkflowScript");
+
+// packages/core/src/agents/workflow-snapshot.ts
+init_esbuild_shims();
+import { promises as fs2 } from "node:fs";
+import path2 from "node:path";
+var debugLogger3 = createDebugLogger("WORKFLOW_SNAPSHOT");
+var MAX_RETAINED_SNAPSHOTS = 30;
+function toSnapshot(task) {
+  if (!isTerminalWorkflowStatus(task.status)) {
+    throw new Error(`Cannot snapshot active workflow ${task.runId}.`);
+  }
+  return {
+    runId: task.runId,
+    ...task.toolUseId ? { toolUseId: task.toolUseId } : {},
+    description: task.description,
+    ...task.workflowName ? { workflowName: task.workflowName } : {},
+    sourceRunId: task.sourceRunId,
+    startMode: task.startMode,
+    meta: task.meta,
+    status: task.status,
+    script: task.script ?? "",
+    scriptPath: task.scriptPath,
+    phases: [...task.phases],
+    phaseVisits: task.phaseVisits.map((visit) => ({ ...visit })),
+    dispatches: task.dispatches.map((dispatch) => ({
+      ...dispatch,
+      dependsOn: [...dispatch.dependsOn]
+    })),
+    agentsDispatched: task.agentsDispatched,
+    agentsCompleted: task.agentsCompleted,
+    tokensSpent: task.tokensSpent,
+    tokenBudgetTotal: task.tokenBudgetTotal,
+    perPhaseTokens: Array.from(task.perPhaseTokens.entries()),
+    recentLogs: [...task.recentLogs],
+    events: task.events.map((event) => ({ ...event })),
+    startTime: task.startTime,
+    endTime: task.endTime,
+    result: safeResult(task.result),
+    error: task.error
+  };
+}
+__name(toSnapshot, "toSnapshot");
+function safeResult(result) {
+  if (result === void 0) return void 0;
+  try {
+    JSON.stringify(result);
+    return result;
+  } catch {
+    return `(non-JSON-serializable ${typeof result})`;
+  }
+}
+__name(safeResult, "safeResult");
+async function writeWorkflowSnapshot(config, task) {
+  const storage = config.storage;
+  if (!storage) return false;
+  try {
+    const snapshot = toSnapshot(task);
+    const dir = storage.getWorkflowRunsDir();
+    await fs2.mkdir(dir, { recursive: true });
+    await fs2.writeFile(
+      storage.getWorkflowRunSnapshotPath(task.runId),
+      JSON.stringify(snapshot, null, 2),
+      "utf8"
+    );
+    await pruneSnapshots(config, dir);
+    return true;
+  } catch (e) {
+    debugLogger3.warn(`writeWorkflowSnapshot failed for ${task.runId}: ${e}`);
+    return false;
+  }
+}
+__name(writeWorkflowSnapshot, "writeWorkflowSnapshot");
+async function listWorkflowSnapshots(config) {
+  const storage = config.storage;
+  if (!storage) return [];
+  const dir = storage.getWorkflowRunsDir();
+  let files;
+  try {
+    files = (await fs2.readdir(dir)).filter((f) => f.endsWith(".json"));
+  } catch {
+    return [];
+  }
+  const snapshots = [];
+  for (const file of files) {
+    try {
+      const raw = await fs2.readFile(`${dir}/${file}`, "utf8");
+      const parsed = JSON.parse(raw);
+      if (!isWorkflowSnapshot(parsed)) {
+        debugLogger3.warn(`skipping invalid workflow snapshot ${file}`);
+        continue;
+      }
+      snapshots.push(parsed);
+    } catch (e) {
+      debugLogger3.warn(`skipping unparseable snapshot ${file}: ${e}`);
+    }
+  }
+  snapshots.sort((a, b) => (b.startTime ?? 0) - (a.startTime ?? 0));
+  return snapshots;
+}
+__name(listWorkflowSnapshots, "listWorkflowSnapshots");
+async function deleteWorkflowSnapshot(config, runId) {
+  const storage = config.storage;
+  if (!storage || !/^wf_[0-9a-f]+$/.test(runId)) return false;
+  try {
+    await fs2.rm(path2.dirname(storage.getWorkflowRunJournalPath(runId)), {
+      recursive: true,
+      force: true
+    });
+  } catch (error) {
+    debugLogger3.warn(`delete workflow journal failed for ${runId}: ${error}`);
+    return false;
+  }
+  if (!await deleteInlineWorkflowScript(config, runId)) return false;
+  try {
+    await fs2.unlink(storage.getWorkflowRunSnapshotPath(runId));
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      debugLogger3.warn(`deleteWorkflowSnapshot failed for ${runId}: ${error}`);
+      return false;
+    }
+  }
+  return true;
+}
+__name(deleteWorkflowSnapshot, "deleteWorkflowSnapshot");
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+__name(isRecord, "isRecord");
+function isFiniteNumber(value) {
+  return typeof value === "number" && Number.isFinite(value);
+}
+__name(isFiniteNumber, "isFiniteNumber");
+function isOptionalString(value) {
+  return value === void 0 || typeof value === "string";
+}
+__name(isOptionalString, "isOptionalString");
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+__name(isStringArray, "isStringArray");
+function isWorkflowMeta(value) {
+  if (value === null) return true;
+  if (!isRecord(value)) return false;
+  if (typeof value["name"] !== "string" || typeof value["description"] !== "string" || !isOptionalString(value["whenToUse"])) {
+    return false;
+  }
+  const phases = value["phases"];
+  return phases === void 0 || Array.isArray(phases) && phases.every(
+    (phase) => isRecord(phase) && typeof phase["title"] === "string" && isOptionalString(phase["detail"]) && isOptionalString(phase["model"])
+  );
+}
+__name(isWorkflowMeta, "isWorkflowMeta");
+function isWorkflowPhaseVisit(value) {
+  return isRecord(value) && typeof value["id"] === "string" && isFiniteNumber(value["index"]) && typeof value["title"] === "string" && isFiniteNumber(value["startedAt"]) && (value["endedAt"] === void 0 || isFiniteNumber(value["endedAt"]));
+}
+__name(isWorkflowPhaseVisit, "isWorkflowPhaseVisit");
+function isWorkflowDispatch(value) {
+  if (!isRecord(value)) return false;
+  const status = value["status"];
+  return typeof value["id"] === "string" && (value["phaseVisitId"] === null || typeof value["phaseVisitId"] === "string") && typeof value["label"] === "string" && typeof value["prompt"] === "string" && isOptionalString(value["subagentId"]) && (status === "queued" || status === "running" || status === "completed" || status === "failed" || status === "cancelled" || status === "cached") && isStringArray(value["dependsOn"]) && isFiniteNumber(value["queuedAt"]) && (value["startedAt"] === void 0 || isFiniteNumber(value["startedAt"])) && (value["endedAt"] === void 0 || isFiniteNumber(value["endedAt"])) && isOptionalString(value["error"]);
+}
+__name(isWorkflowDispatch, "isWorkflowDispatch");
+function hasOnlyKeys(value, keys) {
+  const allowed = new Set(keys);
+  return Object.keys(value).every((key) => allowed.has(key));
+}
+__name(hasOnlyKeys, "hasOnlyKeys");
+function isWorkflowEvent(value) {
+  if (!isRecord(value) || typeof value["id"] !== "string" || !isFiniteNumber(value["at"]) || typeof value["type"] !== "string") {
+    return false;
+  }
+  const base = ["id", "type", "at"];
+  switch (value["type"]) {
+    case "phase-started":
+      return hasOnlyKeys(value, [...base, "phaseVisitId", "title"]) && typeof value["phaseVisitId"] === "string" && typeof value["title"] === "string";
+    case "phase-completed":
+      return hasOnlyKeys(value, [...base, "phaseVisitId"]) && typeof value["phaseVisitId"] === "string";
+    case "dispatch-queued":
+    case "dispatch-started":
+    case "dispatch-completed":
+    case "dispatch-cancelled":
+    case "dispatch-cached":
+      return hasOnlyKeys(value, [...base, "dispatchId"]) && typeof value["dispatchId"] === "string";
+    case "dispatch-failed":
+      return hasOnlyKeys(value, [...base, "dispatchId", "error"]) && typeof value["dispatchId"] === "string" && typeof value["error"] === "string";
+    case "log":
+      return hasOnlyKeys(value, [...base, "message"]) && typeof value["message"] === "string";
+    case "approval-requested":
+    case "approval-settled":
+      return hasOnlyKeys(value, [...base, "name", "dispatchId"]) && typeof value["name"] === "string" && isOptionalString(value["dispatchId"]);
+    case "workflow-completed":
+    case "workflow-cancelled":
+      return hasOnlyKeys(value, base);
+    case "workflow-failed":
+      return hasOnlyKeys(value, [...base, "error"]) && typeof value["error"] === "string";
+    default:
+      return false;
+  }
+}
+__name(isWorkflowEvent, "isWorkflowEvent");
+function isWorkflowSnapshot(value) {
+  if (!isRecord(value)) return false;
+  const status = value["status"];
+  const phaseVisits = value["phaseVisits"];
+  const dispatches = value["dispatches"];
+  const events = value["events"];
+  const perPhaseTokens = value["perPhaseTokens"];
+  return typeof value["runId"] === "string" && value["runId"].length > 0 && isOptionalString(value["toolUseId"]) && isOptionalString(value["description"]) && isOptionalString(value["workflowName"]) && isOptionalString(value["sourceRunId"]) && (value["startMode"] === void 0 || value["startMode"] === "retry" || value["startMode"] === "rerun") && isWorkflowMeta(value["meta"]) && (status === "completed" || status === "failed" || status === "cancelled") && typeof value["script"] === "string" && isOptionalString(value["scriptPath"]) && isStringArray(value["phases"]) && (phaseVisits === void 0 || Array.isArray(phaseVisits) && phaseVisits.every(isWorkflowPhaseVisit)) && (dispatches === void 0 || Array.isArray(dispatches) && dispatches.every(isWorkflowDispatch)) && (events === void 0 || Array.isArray(events) && events.every(isWorkflowEvent)) && isFiniteNumber(value["agentsDispatched"]) && isFiniteNumber(value["agentsCompleted"]) && isFiniteNumber(value["tokensSpent"]) && (value["tokenBudgetTotal"] === null || isFiniteNumber(value["tokenBudgetTotal"])) && Array.isArray(perPhaseTokens) && perPhaseTokens.every(
+    (entry) => Array.isArray(entry) && entry.length === 2 && (entry[0] === null || typeof entry[0] === "string") && isFiniteNumber(entry[1])
+  ) && isStringArray(value["recentLogs"]) && isFiniteNumber(value["startTime"]) && (value["endTime"] === void 0 || isFiniteNumber(value["endTime"])) && isOptionalString(value["error"]);
+}
+__name(isWorkflowSnapshot, "isWorkflowSnapshot");
+async function pruneSnapshots(config, dir) {
+  let files;
+  try {
+    files = (await fs2.readdir(dir)).filter((f) => f.endsWith(".json"));
+  } catch {
+    return;
+  }
+  if (files.length <= MAX_RETAINED_SNAPSHOTS) return;
+  const stats = await Promise.all(
+    files.map(async (f) => {
+      try {
+        const s = await fs2.stat(`${dir}/${f}`);
+        return { f, mtime: s.mtimeMs };
+      } catch {
+        return { f, mtime: 0 };
+      }
+    })
+  );
+  stats.sort((a, b) => a.mtime - b.mtime);
+  const toPrune = stats.slice(0, stats.length - MAX_RETAINED_SNAPSHOTS);
+  const registry = config.getWorkflowRunRegistry?.();
+  const protectedRunIds = /* @__PURE__ */ new Set([
+    ...(registry?.list() ?? []).filter((entry) => isActiveWorkflowStatus(entry.status)).map((entry) => entry.runId),
+    ...registry?.listStartingRunIds() ?? []
+  ]);
+  await Promise.all(
+    toPrune.map((s) => {
+      const runId = s.f.replace(/\.json$/, "");
+      const isRunDir = /^wf_[0-9a-f]+$/.test(runId);
+      const deleteArtifacts = isRunDir && !protectedRunIds.has(runId) && !isWorkflowRunPersistenceActive(config, runId);
+      return Promise.all([
+        fs2.unlink(`${dir}/${s.f}`).catch(
+          (e) => debugLogger3.warn(`prune unlink failed for ${s.f}: ${e}`)
+        ),
+        ...deleteArtifacts ? [
+          fs2.rm(
+            path2.dirname(config.storage.getWorkflowRunJournalPath(runId)),
+            { recursive: true, force: true }
+          ).catch(
+            (e) => debugLogger3.warn(
+              `prune journal dir failed for ${runId}: ${e}`
+            )
+          ),
+          deleteInlineWorkflowScript(config, runId)
+        ] : []
+      ]);
+    })
+  );
+}
+__name(pruneSnapshots, "pruneSnapshots");
+
+export {
+  extractAndStripMeta,
+  compileWorkflowScript,
+  describeWorkflowCompileError,
+  debugLogger,
+  createWorkflowSandbox,
+  validateWorkflowName,
+  isSymlinkedRoot,
+  listSavedWorkflows,
+  resolveSavedWorkflowScript,
+  saveWorkflowScript,
+  persistInlineWorkflowScript,
+  deleteInlineWorkflowScript,
+  MAX_RETAINED_SNAPSHOTS,
+  toSnapshot,
+  writeWorkflowSnapshot,
+  listWorkflowSnapshots,
+  deleteWorkflowSnapshot
+};
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * @license
+ * Copyright 2025 Qwen
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * @license
+ * Copyright 2026 Qwen Team
+ * SPDX-License-Identifier: Apache-2.0
+ */