@qwen-code/qwen-code 0.23.5-dev.codemode-responses.20260915.f024b37689 → 0.23.5-preview.0

package/chunks/{workflow-BLJLID2C.js → workflow-O7L6VDYU.js}

@@ -15,69 +15,82 @@ import {
   WorkflowExecutionError,
   WorkflowJournal,
   WorkflowOrchestrator,
-  compileWorkflowScript,
   createProductionDispatch,
-  deleteInlineWorkflowScript,
-  describeWorkflowCompileError,
-  extractAndStripMeta,
-  isSymlinkedRoot,
-  persistInlineWorkflowScript,
+  describeWorkflowDeterminismViolations,
   readWorkflowAuthoringReference,
   resolveConcurrencyLimit,
-  resolveMaxTokensPerWorkflow,
   resolveReviewWorkflowLimits,
-  resolveSavedWorkflowScript,
   resolveWorkflowAuthoringSurface,
+  scanWorkflowScriptShape,
   toolSearchRevealSentence,
   writeWorkflowSnapshot
-} from "./chunk-SGXJQP5Q.js";
+} from "./chunk-SFHX5G2S.js";
 import {
   RESUME_ARGS_TOO_LARGE_NOTE,
   buildFailureLines,
   buildResumeCall,
+  buildWorkflowSizeGuidelineParagraph,
+  compileWorkflowScript,
+  computeWorkflowScriptDigest,
+  deleteInlineWorkflowScript,
+  describeWorkflowCompileError,
+  evaluateWorkflowSize,
+  extractAndStripMeta,
+  findActiveExtensionWorkflowByPath,
+  findActiveExtensionWorkflowByPathCanonical,
+  getActiveExtensionWorkflows,
   getRuleDisplayName,
   getWorkflowTaskMutationKey,
   hasUninlinableResumeArgs,
+  isSymlinkedRoot,
   isTerminalWorkflowStatus,
   markWorkflowRunPersistenceActive,
+  parseExtensionWorkflowName,
+  persistInlineWorkflowScript,
+  readWorkflowSourceRef,
+  resolveSavedWorkflowScript,
   resolveToolName,
+  resolveWorkflowSizeCaps,
+  resolveWorkflowSizeGuidelineSetting,
   tryWithWorkflowTaskMutation
-} from "./chunk-WBP64MZR.js";
+} from "./chunk-KAYC5FBN.js";
 import "./chunk-GOFAQQZA.js";
+import "./chunk-65I7S4Z3.js";
 import "./chunk-HEOH7JZY.js";
 import "./chunk-TWPJO254.js";
 import "./chunk-CQ35AJ4Z.js";
-import "./chunk-65I7S4Z3.js";
+import "./chunk-IVFTLUZD.js";
 import "./chunk-7CLLH5TI.js";
 import "./chunk-WK6DEH3Q.js";
 import "./chunk-6PVPNMXU.js";
-import "./chunk-4OQSG35W.js";
-import "./chunk-ME4JBHSB.js";
-import "./chunk-GNV2SFO7.js";
+import "./chunk-DX6JTDMR.js";
+import "./chunk-VQDWCQOE.js";
 import "./chunk-5EZRLTLQ.js";
 import "./chunk-QHWCP53L.js";
 import "./chunk-3LMDSCLU.js";
-import "./chunk-O6GEWCJA.js";
-import "./chunk-WKVZES7O.js";
-import "./chunk-NJ2OFVUX.js";
-import "./chunk-HFJSQ4GL.js";
 import "./chunk-QJNDUTOL.js";
+import "./chunk-O6GEWCJA.js";
+import "./chunk-CXONOVBN.js";
+import "./chunk-OWUAZXXN.js";
+import "./chunk-CH2YDT6X.js";
+import "./chunk-P42KMMU6.js";
+import "./chunk-BTICBRPL.js";
 import "./chunk-V545KI73.js";
-import "./chunk-MQRLLBMQ.js";
+import "./chunk-ADN5KESB.js";
+import "./chunk-PPJSG2PU.js";
 import "./chunk-ELRMZTPF.js";
 import "./chunk-U6H3XTFA.js";
 import "./chunk-ACHCT36C.js";
 import "./chunk-CHEIIBT3.js";
 import "./chunk-AEWCOE64.js";
-import "./chunk-OWUAZXXN.js";
-import "./chunk-CH2YDT6X.js";
 import "./chunk-JX6XHPTX.js";
 import "./chunk-ZSTCM3MX.js";
+import "./chunk-SK3RZOPS.js";
 import "./chunk-MLXTMF7H.js";
-import "./chunk-AXZMWAJV.js";
+import "./chunk-36SDZ2Q4.js";
 import "./chunk-NXUZFW3G.js";
 import "./chunk-WFNEY5G7.js";
-import "./chunk-GSS4SZNG.js";
+import "./chunk-YP2K3WOS.js";
 import "./chunk-BW2SMO6L.js";
 import "./chunk-S6LOFUVP.js";
 import "./chunk-VVI7MK3V.js";
@@ -87,45 +100,42 @@ import "./chunk-IZ2U57NY.js";
 import "./chunk-Z72PLR74.js";
 import "./chunk-NUQ4GK5I.js";
 import "./chunk-NAVJD2PQ.js";
-import "./chunk-66N6C4EH.js";
-import "./chunk-FMLBBXHB.js";
+import "./chunk-3WILPKTJ.js";
+import "./chunk-DRAX5YAI.js";
 import "./chunk-S7UQ3V2H.js";
-import "./chunk-JL6APGBX.js";
 import {
   createAbortController,
   createChildAbortController
 } from "./chunk-DJ2GSRLV.js";
-import "./chunk-ZKIAGIGH.js";
-import "./chunk-VGY2RGXL.js";
-import "./chunk-C75BXMPM.js";
+import "./chunk-3XBUCOWS.js";
+import "./chunk-M4U2LTD2.js";
 import "./chunk-KFFCDLKV.js";
 import "./chunk-KP2FHIFR.js";
-import "./chunk-L6DIANLD.js";
+import "./chunk-KEM7MWS7.js";
+import "./chunk-G45B3INR.js";
 import {
   WorkflowRunEvent,
-  logWorkflowRun
-} from "./chunk-FCLMJS6N.js";
+  WorkflowSizeWarningEvent,
+  logWorkflowRun,
+  logWorkflowSizeWarning
+} from "./chunk-CDDP4ONL.js";
 import "./chunk-5ETULJLP.js";
-import "./chunk-7MIBD3LG.js";
 import "./chunk-VGC4I5JJ.js";
 import {
   isWithinRoot
-} from "./chunk-QZW6WRB7.js";
+} from "./chunk-5NUKK2DT.js";
 import "./chunk-EDIDYZBT.js";
 import "./chunk-HD7O6WLV.js";
 import "./chunk-CFMZLE3L.js";
 import "./chunk-WZAD4ZNJ.js";
-import "./chunk-ARDHE6MM.js";
-import "./chunk-FPGTNKCP.js";
 import "./chunk-TIGXX4PA.js";
-import "./chunk-TPEV2QHG.js";
 import "./chunk-XFFRI3WM.js";
-import "./chunk-ERU3SDXT.js";
-import "./chunk-EWJTAP3Y.js";
+import "./chunk-GJKP6XOB.js";
+import "./chunk-7O5PYQ3M.js";
 import "./chunk-HHJLM3WQ.js";
 import {
   stripAnsiAndControl
-} from "./chunk-4Y2I3CI3.js";
+} from "./chunk-6USYH3EU.js";
 import "./chunk-74TONY4F.js";
 import "./chunk-SYROIHU7.js";
 import {
@@ -163,6 +173,7 @@ var WorkflowRunHandle = class {
     this.scheduler = scheduler;
     this.scriptPath = locations.scriptPath;
     this.journalPath = locations.journalPath;
+    this.sourceRef = locations.sourceRef;
     this.completion = Promise.resolve().then(start);
   }
   static {
@@ -179,6 +190,7 @@ var WorkflowRunHandle = class {
   scriptPath;
   /** This run's resume journal, when the config has a `storage` to hold one. */
   journalPath;
+  sourceRef;
   abort() {
     this.controller.abort();
   }
@@ -189,13 +201,21 @@ var WorkflowRunHandle = class {
     return this.scheduler.resume();
   }
 };
+var WORKFLOW_SCRIPT_SYNTAX_HINT = "Workflow scripts must be plain JavaScript \u2014 the usual causes are TypeScript syntax (type annotations, interfaces, generics) and broken string quoting or escaping. Metadata must use literal values.";
 var WorkflowScriptNotLaunchedError = class extends Error {
-  constructor(detail) {
+  /**
+   * @param detail What is wrong with the script.
+   * @param hint The usual causes, appended after `detail`. Defaults to the
+   *   syntax causes of a compile failure; a refusal with a cause of its own
+   *   passes an empty hint, so the reader is not sent looking for TypeScript
+   *   syntax that is not there.
+   */
+  constructor(detail, hint = WORKFLOW_SCRIPT_SYNTAX_HINT) {
     super(
       `Workflow script is invalid and was not launched:
-${detail}
+${detail}` + (hint ? `
 
-Workflow scripts must be plain JavaScript \u2014 the usual causes are TypeScript syntax (type annotations, interfaces, generics) and broken string quoting or escaping. Metadata must use literal values.`
+${hint}` : "")
     );
     this.detail = detail;
     this.name = "WorkflowScriptNotLaunchedError";
@@ -235,7 +255,10 @@ var WorkflowRunner = class {
   static async startClaimed(options) {
     const config = options.config;
     const runInBackground = options.runInBackground === true;
-    const budget = WorkflowBudgetImpl.fromEnv();
+    const budget = WorkflowBudgetImpl.fromConfig(config);
+    const sizeCaps = resolveWorkflowSizeCaps(
+      config.getWorkflowSizeGuideline?.() ?? resolveWorkflowSizeGuidelineSetting(void 0)
+    );
     const runId = options.resumeFromRunId ?? `wf_${randomBytes(8).toString("hex")}`;
     const registry = config.getWorkflowRunRegistry?.();
     let entry;
@@ -261,12 +284,13 @@ var WorkflowRunner = class {
     let script;
     let scriptPath;
     let resumeReplay;
+    let sourceRef;
     let persistedInlineScript = false;
     let callerWasAbortedBeforeStart;
     let orchestrator;
     let reviewLimits;
     try {
-      const loaded = options.scriptPath && options.script === void 0 ? await resolveSavedWorkflowScript(
+      const loaded = options.loadScript ? await options.loadScript() : options.scriptPath && options.script === void 0 ? await resolveSavedWorkflowScript(
         { scriptPath: options.scriptPath },
         config
       ) : void 0;
@@ -290,9 +314,45 @@ var WorkflowRunner = class {
           )
         );
       }
+      const determinismViolations = scanWorkflowScriptShape(script).determinismViolations;
+      if (determinismViolations.length > 0) {
+        throw new WorkflowScriptNotLaunchedError(
+          describeWorkflowDeterminismViolations(determinismViolations),
+          ""
+        );
+      }
       resumeReplay = options.resumeFromRunId ? await journal?.load() : void 0;
+      sourceRef = readWorkflowSourceRef(options.sourceRef);
+      if (resumeReplay?.sourceError) throw new Error(resumeReplay.sourceError);
+      if (options.resumeFromRunId) {
+        const original = resumeReplay?.sourceRef;
+        if (sourceRef && (!original || sourceRef.id !== original.id || sourceRef.revision !== original.revision)) {
+          throw new Error(
+            "Workflow sourceRef must match the original journal. Start a new run to use a different source."
+          );
+        }
+        if (previousEntry?.sourceRef && !original) {
+          throw new Error(
+            "Workflow source metadata is missing from its journal."
+          );
+        }
+        sourceRef = original;
+      }
       assertStartNotCancelled();
       callerWasAbortedBeforeStart = options.signal.aborted;
+      if (journal && !await journal.ensureExists()) {
+        journalPath = void 0;
+      }
+      if (sourceRef) {
+        if (!journal || !journalPath) {
+          throw new Error(
+            "Workflow sourceRef requires a writable resume journal."
+          );
+        }
+        if (!options.resumeFromRunId) {
+          await journal.append({ type: "source", version: 1, sourceRef });
+        }
+      }
       if (options.script !== void 0 && scriptPath === void 0) {
         const persisted = await persistInlineWorkflowScript(
           config,
@@ -302,9 +362,6 @@ var WorkflowRunner = class {
         scriptPath = persisted ?? void 0;
         persistedInlineScript = persisted !== null;
       }
-      if (journal && !await journal.ensureExists()) {
-        journalPath = void 0;
-      }
       assertStartNotCancelled();
       const dispatch = options.dispatch ?? createProductionDispatch(
         config,
@@ -324,12 +381,15 @@ var WorkflowRunner = class {
           runId,
           toolUseId: options.toolUseId,
           ...workflowName ? { workflowName } : {},
+          ...sourceRef ? { sourceRef } : {},
           meta: null,
           status: "running",
           startTime: Date.now(),
           outputFile: "",
           abortController: controller,
-          tokenBudgetTotal: budget.total,
+          // The registry and `/workflows` show one run: a turn target is not
+          // this run's cap, and its spend is not this run's alone.
+          tokenBudgetTotal: budget.runCap(),
           script,
           scriptPath,
           ...journalPath ? { journalPath } : {},
@@ -370,7 +430,39 @@ var WorkflowRunner = class {
       } catch {
       }
     }, "emitUpdate");
+    const maybeWarnSize = /* @__PURE__ */ __name(() => {
+      const current = registry?.get(runId);
+      if (!registry || !current || current.sizeWarning !== void 0) return;
+      let scheduledAgents = 0;
+      let settledAgents = 0;
+      for (const dispatch of current.dispatches) {
+        if (dispatch.status === "cached") continue;
+        scheduledAgents++;
+        if (dispatch.status === "completed" || dispatch.status === "failed" || dispatch.status === "cancelled") {
+          settledAgents++;
+        }
+      }
+      const warning = evaluateWorkflowSize(
+        { scheduledAgents, settledAgents, tokensSpent: current.tokensSpent },
+        sizeCaps
+      );
+      if (!warning || !registry.onSizeWarning(runId, warning)) return;
+      try {
+        logWorkflowSizeWarning(config, new WorkflowSizeWarningEvent(warning));
+      } catch {
+      }
+    }, "maybeWarnSize");
     const emitter = {
+      workflowCallUpdated: /* @__PURE__ */ __name((call) => {
+        if (!isCurrentEntry()) return;
+        registry?.onWorkflowCallUpdated(runId, call);
+        emitUpdate();
+      }, "workflowCallUpdated"),
+      workflowCallsTruncated: /* @__PURE__ */ __name(() => {
+        if (!isCurrentEntry()) return;
+        registry?.onWorkflowCallsTruncated(runId);
+        emitUpdate();
+      }, "workflowCallsTruncated"),
       phaseStarted: /* @__PURE__ */ __name((title) => {
         if (!isCurrentEntry()) return;
         registry?.onPhaseStarted(runId, title);
@@ -388,6 +480,7 @@ var WorkflowRunner = class {
       dispatchQueued: /* @__PURE__ */ __name((event) => {
         if (!isCurrentEntry()) return;
         registry?.onDispatchQueued(runId, event);
+        maybeWarnSize();
         emitUpdate();
       }, "dispatchQueued"),
       dispatchStarted: /* @__PURE__ */ __name((dispatchId, startedAt) => {
@@ -415,6 +508,7 @@ var WorkflowRunner = class {
       budgetUpdated: /* @__PURE__ */ __name((spent, total) => {
         if (!isCurrentEntry()) return;
         registry?.onBudgetUpdated(runId, spent, total);
+        maybeWarnSize();
         emitUpdate();
       }, "budgetUpdated"),
       resumeRespawn: /* @__PURE__ */ __name((line) => {
@@ -528,7 +622,8 @@ var WorkflowRunner = class {
       },
       {
         ...scriptPath ? { scriptPath } : {},
-        ...journalPath ? { journalPath } : {}
+        ...journalPath ? { journalPath } : {},
+        ...sourceRef ? { sourceRef } : {}
       }
     );
     registry?.attachHandle(handle);
@@ -551,13 +646,27 @@ import * as path from "node:path";
 var WORKFLOW_PARAM_SCHEMA = {
   type: "object",
   properties: {
+    sourceRef: {
+      type: "object",
+      description: "Optional caller-supplied definition id and revision for run correlation. Requires a writable journal; omit for ordinary workflows.",
+      properties: {
+        id: { type: "string", minLength: 1, maxLength: 256 },
+        revision: { type: "string", minLength: 1, maxLength: 256 }
+      },
+      required: ["id", "revision"],
+      additionalProperties: false
+    },
     script: {
       type: "string",
       description: "JavaScript source of the workflow, wrapped as an async IIFE: top-level `await` and `return` are both legal, and a trailing expression is NOT a return value. Uses the injected globals `phase()`, `log()`, `agent()`, `parallel()`, `pipeline()`, `workflow()`, `args` and `budget`, and cannot import anything. May start with a literal `export const meta = {...}` (stripped before execution). `Math.random()` and all of `Date` (`new Date()`, `Date.now()` included) throw \u2014 a script must be deterministic for resume, so pass timestamps in via `args` or stamp the result after the run returns. Pass THUNKS to parallel(), not eager calls: `parallel([() => agent(...)])`, not `parallel([agent(...)])`."
     },
     scriptPath: {
       type: "string",
-      description: "Optional. Absolute path to a workflow `.js` file to load and run instead of inline `script`. Primarily set by the `/<name>` saved-workflow slash command; a tool that generated a script for this run hands you its path the same way. The file must resolve inside a saved-workflow directory (`.qwen/workflows`, `~/.qwen/workflows`) or the generated-scripts root (`$QWEN_CODE_PROJECT_DIR/workflows/generated` \u2014 the per-project runtime dir, not the project tree) \u2014 any other path is refused. Provide exactly ONE of `script` or `scriptPath`. The file is read at execution time, so edits to a saved workflow take effect on the next run. An inline `script` is persisted to `<generated root>/inline/<runId>.js` and that path comes back in the result, so a resume passes the path instead of the source."
+      description: "Optional. Absolute path to a workflow `.js` file to load and run instead of inline `script`. Primarily set by the `/<name>` saved-workflow slash command; a tool that generated a script for this run hands you its path the same way. The file must resolve inside a saved-workflow directory (`.qwen/workflows`, `~/.qwen/workflows`), be a workflow file an active extension ships, or sit under the generated-scripts root (`$QWEN_CODE_PROJECT_DIR/workflows/generated` \u2014 the per-project runtime dir, not the project tree) \u2014 any other path is refused. Provide exactly ONE of `script`, `scriptPath` or `name`. The file is read once per call, before approval, so edits to a saved workflow take effect on the next call. An inline `script` is persisted to `<generated root>/inline/<runId>.js` and that path comes back in the result, so a resume passes the path instead of the source."
+    },
+    name: {
+      type: "string",
+      description: "Optional. Name of a saved workflow to run instead of inline `script`: `<name>` for one in `.qwen/workflows` or `~/.qwen/workflows`, or `<extension>:<name>` for one an active extension ships. Provide exactly ONE of `script`, `scriptPath` or `name`."
     },
     args: {
       description: "Optional structured value bound to the `args` global. Pass actual JSON, not a stringified value."
@@ -572,10 +681,10 @@ var WORKFLOW_PARAM_SCHEMA = {
       description: "Optional. When true, start the workflow under the interactive session and return a run handle immediately. The Background Tasks view can observe, cooperatively pause/resume, or stop it, and completion is delivered to the conversation when the run settles. Interactive TUI only. Defaults to false."
     }
   }
-  // `script` is required UNLESS `scriptPath` is supplied; this XOR can't be
-  // expressed as a plain `required` list, so it's enforced in
-  // `validateToolParamValues`. Inline authoring (the LLM path) should always
-  // pass `script`; the `scriptPath` property description states the XOR.
+  // Exactly one of `script`, `scriptPath` and `name`; that can't be expressed
+  // as a plain `required` list, so it's enforced in `validateToolParamValues`.
+  // Inline authoring (the LLM path) passes `script`; the `scriptPath` and
+  // `name` property descriptions state the rule.
 };
 var WorkflowToolInvocation = class extends BaseToolInvocation {
   constructor(config, toolOptions, params, authoringHint, workflowName) {
@@ -600,7 +709,7 @@ var WorkflowToolInvocation = class extends BaseToolInvocation {
     if (!this.authoringHint) return null;
     return isScriptAuthoredByThisCall(
       this.config,
-      this.workflowName,
+      this.workflowName ?? this.params.name,
       this.params.scriptPath
     ) ? this.authoringHint : null;
   }
@@ -619,25 +728,82 @@ var WorkflowToolInvocation = class extends BaseToolInvocation {
     }
     return this.metaCache;
   }
+  /**
+   * The file a `scriptPath` or `name` call runs, read once. The permission
+   * check, the approval dialog and the run all use this one read, so the
+   * script the user approved is the script that runs, even when the file
+   * changes while the dialog is open.
+   */
+  scriptLoad;
+  /** {@link scriptLoad} once settled, for the synchronous rule-match hook. */
+  settledScriptLoad;
+  loadReferencedScript() {
+    if (this.params.script !== void 0) return void 0;
+    const { name, scriptPath } = this.params;
+    if (!name && !scriptPath) return void 0;
+    this.scriptLoad ??= (async () => {
+      try {
+        const loaded = await resolveSavedWorkflowScript(
+          name ? name : { scriptPath },
+          this.config
+        );
+        return {
+          ok: true,
+          loaded,
+          digest: computeWorkflowScriptDigest(loaded.script)
+        };
+      } catch (error) {
+        return { ok: false, error };
+      }
+    })().then((load) => {
+      this.settledScriptLoad = load;
+      return load;
+    });
+    return this.scriptLoad;
+  }
   getDescription() {
     const meta = this.resolveMeta();
     if (meta) {
       return `Run workflow: ${sanitizeLine(meta.name)}`;
     }
+    if (this.params.name && this.params.script === void 0) {
+      const kind = parseExtensionWorkflowName(this.params.name) ? "extension" : "saved";
+      return `Run ${kind} workflow (${sanitizeLine(this.params.name)})`;
+    }
     if (this.params.scriptPath && this.params.script === void 0) {
-      const kind = isGeneratedWorkflowScriptPath(
+      if (isGeneratedWorkflowScriptPath(this.config, this.params.scriptPath)) {
+        return `Run generated workflow script (${path.basename(this.params.scriptPath)})`;
+      }
+      const extensionWorkflow = findActiveExtensionWorkflowByPath(
         this.config,
         this.params.scriptPath
-      ) ? "generated workflow script" : "saved workflow";
-      return `Run ${kind} (${path.basename(this.params.scriptPath)})`;
+      );
+      if (extensionWorkflow) {
+        return `Run extension workflow (${sanitizeLine(extensionWorkflow.name)})`;
+      }
+      return `Run saved workflow (${path.basename(this.params.scriptPath)})`;
     }
     return `Run a workflow script (${this.params.script?.length ?? 0} chars)`;
   }
   toolLocations() {
     return [];
   }
-  getDefaultPermission() {
-    return Promise.resolve("ask");
+  async getDefaultPermission() {
+    const load = await this.loadReferencedScript();
+    return load && !load.ok ? "allow" : "ask";
+  }
+  /**
+   * An "always allow" for a saved or extension workflow is pinned to the
+   * script it approved: `Workflow(name:gcp:audit,sha256:…)`. The digest is
+   * computed from the file this call loaded. A `sha256` the model passed is
+   * overwritten, and a call that loaded nothing matches no digest.
+   */
+  getPermissionMatchParams() {
+    const load = this.settledScriptLoad;
+    return {
+      ...this.params,
+      [WORKFLOW_RULE_DIGEST_KEY]: load?.ok ? load.digest : void 0
+    };
   }
   /**
    * Show what is about to run, and scope the grant that approves it.
@@ -658,12 +824,16 @@ var WorkflowToolInvocation = class extends BaseToolInvocation {
    *     empty `permissionRules` stops `injectPermissionRulesIfMissing` from
    *     supplying the bare-tool-name rule, which `buildPermissionRules`
    *     documents as matching *all* invocations.
-   *   - A `scriptPath` names a file on disk that the user chose, so it can be
-   *     pre-approved — but scoped to that path. The rule is built with the
-   *     same helpers the matcher uses so a tool rename moves both sides.
+   *   - A `scriptPath` or `name` names a file on disk that the user chose,
+   *     so it can be pre-approved — scoped to that path or name, and pinned
+   *     to the digest of the content shown here, so a changed script asks
+   *     again. The rule is built with the same helpers the matcher uses so a
+   *     tool rename moves both sides.
    */
   async getConfirmationDetails(_abortSignal) {
-    const meta = this.resolveMeta();
+    const load = await this.loadReferencedScript();
+    const loaded = load?.ok ? load : void 0;
+    const meta = loaded ? readMetaForConfirmation(loaded.loaded.script) : this.resolveMeta();
     const isGeneratedScriptPath = this.params.scriptPath !== void 0 && await isGeneratedWorkflowScriptPathCanonical(
       this.config,
       this.params.scriptPath
@@ -672,17 +842,29 @@ var WorkflowToolInvocation = class extends BaseToolInvocation {
       this.params.scriptPath,
       path.dirname(this.config.storage.getInlineWorkflowScriptPath("wf_0"))
     );
+    const extensionWorkflow = isGeneratedScriptPath ? void 0 : this.params.name ? getActiveExtensionWorkflows(this.config).find(
+      (workflow) => workflow.name === this.params.name
+    ) : this.params.scriptPath !== void 0 ? await findActiveExtensionWorkflowByPathCanonical(
+      this.config,
+      this.params.scriptPath
+    ) : void 0;
     const body = buildConfirmationPrompt(
       this.params,
       meta,
-      isGeneratedScriptPath
+      isGeneratedScriptPath ? { kind: "generated" } : extensionWorkflow ? { kind: "extension", workflow: extensionWorkflow } : { kind: "saved" },
+      loaded ? {
+        scriptPath: loaded.loaded.scriptPath,
+        script: loaded.loaded.script,
+        digest: loaded.digest
+      } : load ? { error: describeLoadError(load) } : void 0
     );
     const banner = resolveUsageBanner(
       this.config,
       this.config.getWorkflowRunRegistry?.(),
-      resolveMaxTokensPerWorkflow()
+      WorkflowBudgetImpl.fromConfig(this.config)
     );
     const isInlineScript = this.params.script !== void 0 || isGeneratedInlineScriptPath;
+    const grantRule = isInlineScript || !loaded ? void 0 : buildWorkflowGrantRule(this.params, loaded.digest);
     const details = {
       type: "info",
       title: "Run a dynamic workflow?",
@@ -690,10 +872,8 @@ var WorkflowToolInvocation = class extends BaseToolInvocation {
       // The body is a script excerpt and a phase list: rendering it as
       // Markdown would swallow the very characters the reader needs to see.
       renderPromptAsPlainText: true,
-      hideAlwaysAllow: isInlineScript,
-      permissionRules: isInlineScript ? [] : [
-        `${getRuleDisplayName(resolveToolName(ToolNames.WORKFLOW))}(scriptPath:${this.params.scriptPath})`
-      ],
+      hideAlwaysAllow: grantRule === void 0,
+      permissionRules: grantRule ? [grantRule] : [],
       onConfirm: /* @__PURE__ */ __name(async (_outcome, _payload) => {
       }, "onConfirm")
     };
@@ -704,6 +884,7 @@ var WorkflowToolInvocation = class extends BaseToolInvocation {
     if (runInBackground && signal.aborted) {
       return startCancelledResult();
     }
+    const load = this.loadReferencedScript();
     let handle;
     try {
       handle = await WorkflowRunner.start({
@@ -714,7 +895,9 @@ var WorkflowToolInvocation = class extends BaseToolInvocation {
         ...authoringHintOption(this.authoredScriptHint()),
         script: this.params.script,
         scriptPath: this.params.scriptPath,
+        ...load ? { loadScript: /* @__PURE__ */ __name(() => unwrapScriptLoad(load), "loadScript") } : {},
         args: this.params.args,
+        sourceRef: this.params.sourceRef,
         resumeFromRunId: this.params.resumeFromRunId,
         dispatch: this.toolOptions.dispatch,
         runInBackground,
@@ -744,12 +927,13 @@ ${hint}` : error.message;
       const usageBanner = resolveUsageBanner(
         this.config,
         handle.registry,
-        handle.budget.total
+        handle.budget
       );
       return {
         workflowRunId: handle.runId,
         ...handle.scriptPath ? { scriptPath: handle.scriptPath } : {},
         ...handle.journalPath ? { journalPath: handle.journalPath } : {},
+        ...handle.sourceRef ? { sourceRef: handle.sourceRef } : {},
         llmContent: [
           {
             text: buildBackgroundStartText(handle, status)
@@ -764,11 +948,12 @@ ${hint}` : error.message;
       const usageBanner = resolveUsageBanner(
         this.config,
         handle.registry,
-        handle.budget.total
+        handle.budget
       );
       const llmText = safeStringifyResult(outcome.result);
       const displayJson = safeStringifyDisplayPayload({
         runId: outcome.runId,
+        ...handle.sourceRef ? { sourceRef: handle.sourceRef } : {},
         ...outcome.meta ? { meta: outcome.meta } : {},
         phases: outcome.phases,
         logs: outcome.logs,
@@ -779,16 +964,23 @@ ${hint}` : error.message;
         // tokens whenever ANY usage is reported OR a cap is set, not
         // only when spend > 0. A capped-but-zero-spend run still wants
         // the cap visible so the user sees the gate engaged.
-        ...handle.budget.spent() > 0 || handle.budget.total !== null ? {
+        // Per run, like `/workflows`; a turn target adds the turn's figures
+        // beside them rather than in place of them.
+        ...handle.budget.runSpent() > 0 || handle.budget.total !== null ? {
           tokens: {
-            spent: handle.budget.spent(),
-            total: handle.budget.total
+            spent: handle.budget.runSpent(),
+            total: handle.budget.runCap(),
+            ...handle.budget.source === "directive" ? {
+              turnSpent: handle.budget.spent(),
+              turnTotal: handle.budget.total
+            } : {}
           }
         } : {}
       });
       return {
         ...handle.scriptPath ? { scriptPath: handle.scriptPath } : {},
         ...handle.journalPath ? { journalPath: handle.journalPath } : {},
+        ...handle.sourceRef ? { sourceRef: handle.sourceRef } : {},
         // Two parts: the script's return value is left exactly as it was,
         // and the run handle follows as a separate part. Note what this does
         // NOT mean — `convertToFunctionResponse` joins the text parts with a
@@ -833,6 +1025,7 @@ ${safeStringifyDisplayPayload(
       return {
         ...handle.scriptPath ? { scriptPath: handle.scriptPath } : {},
         ...handle.journalPath ? { journalPath: handle.journalPath } : {},
+        ...handle.sourceRef ? { sourceRef: handle.sourceRef } : {},
         // The failure message alone names what threw but not where to look:
         // the logs the runtime already mirrored (`dispatch failed (result not
         // consumed)` and friends) only reached `returnDisplay`, which the
@@ -880,9 +1073,10 @@ function buildRunTrailer(config, handle, args, logs, includeResume = true, autho
       `agents: ${entry.dispatches.length} dispatched` + (respawned > 0 ? ` (${respawned} re-ran from a prior run)` : "") + ` \xB7 ${countByStatus("completed")} completed \xB7 ${countByStatus("cached")} cached \xB7 ${failedCount} failed \xB7 ${countByStatus("cancelled")} cancelled`
     );
   }
-  const spent = handle.budget.spent();
+  const budget = handle.budget;
+  const runSpent = budget.runSpent();
   lines.push(
-    handle.budget.total === null ? `tokens: ${spent} spent (no cap)` : `tokens: ${spent} / ${handle.budget.total} spent`
+    budget.source === "directive" && budget.total !== null ? `tokens: ${runSpent} spent by this run \xB7 ${budget.spent()} / ${budget.total} this turn` + (budget.directiveText ? ` (${sanitizeLine(budget.directiveText)} directive)` : "") : budget.total === null ? `tokens: ${runSpent} spent (no cap)` : `tokens: ${runSpent} / ${budget.total} spent`
   );
   const failures = entry ? buildFailureLines(entry) : [];
   if (failures.length > 0 && entry) {
@@ -899,7 +1093,8 @@ function buildRunTrailer(config, handle, args, logs, includeResume = true, autho
     args
   });
   if (resume && includeResume) {
-    const pathAdvice = entry?.workflowName || !isGeneratedWorkflowScriptPath(config, handle.scriptPath) ? "this reads the saved workflow; copy it before making a run-specific change" : "edit that generated copy first if the script needs to change";
+    const isExtensionWorkflow = entry?.workflowName !== void 0 && parseExtensionWorkflowName(entry.workflowName) !== null || findActiveExtensionWorkflowByPath(config, handle.scriptPath) !== void 0;
+    const pathAdvice = isExtensionWorkflow ? "this reads an extension's workflow file; copy it into .qwen/workflows before making a run-specific change" : entry?.workflowName || !isGeneratedWorkflowScriptPath(config, handle.scriptPath) ? "this reads the saved workflow; copy it before making a run-specific change" : "edit that generated copy first if the script needs to change";
     const journalAdvice = handle.journalPath ? "the journal replays the longest unchanged prefix of agent() calls, and the first changed call onward runs live" : "no journal was written for this run, so every agent() call runs live";
     lines.push(`resume: ${resume} \u2014 ${pathAdvice}; ${journalAdvice}.`);
     if (hasUninlinableResumeArgs({ runId: handle.runId, args })) {
@@ -967,16 +1162,18 @@ function buildLivePhaseTreeDisplay(entry) {
   }
 }
 __name(buildLivePhaseTreeDisplay, "buildLivePhaseTreeDisplay");
-function resolveUsageBanner(config, registry, budgetTotal) {
+function resolveUsageBanner(config, registry, budget) {
   if (!registry) return "";
   if (config.getSkipWorkflowUsageWarning?.()) return "";
   if (!registry.shouldShowUsageWarning()) return "";
-  return buildUsageBanner(budgetTotal);
+  return buildUsageBanner(budget);
 }
 __name(resolveUsageBanner, "resolveUsageBanner");
 var CONFIRM_SCRIPT_EXCERPT_CHARS = 1200;
 var CONFIRM_ARGS_CHARS = 300;
 var CONFIRM_MAX_PHASES = 12;
+var CONFIRM_MAX_STRUCTURE_ROWS = 12;
+var CONFIRM_STRUCTURE_HEADING = "Structure (where the script calls agent(); a loop or a fan-out runs each call many times):";
 function sanitizeLine(text) {
   return stripAnsiAndControl(text);
 }
@@ -1027,16 +1224,40 @@ async function isWorkflowScriptPathWithinCanonicalRoot(scriptPath, root) {
   return isWithinRoot(realScriptPath, realRoot);
 }
 __name(isWorkflowScriptPathWithinCanonicalRoot, "isWorkflowScriptPathWithinCanonicalRoot");
-function buildConfirmationPrompt(params, meta, isGeneratedScriptPath) {
+function buildConfirmationPrompt(params, meta, provenance, referenced) {
   const lines = [];
-  if (meta) {
-    lines.push(`Workflow: ${sanitizeLine(meta.name)}`);
-    lines.push(sanitizeLine(meta.description));
-  } else if (params.scriptPath) {
-    const label = isGeneratedScriptPath ? "Generated workflow script" : "Saved workflow";
-    lines.push(`${label}: ${sanitizeLine(params.scriptPath)}`);
+  const loaded = referenced && "script" in referenced ? referenced : void 0;
+  const loadError = referenced && "error" in referenced ? referenced.error : void 0;
+  const isReference = params.script === void 0 && Boolean(params.name || params.scriptPath);
+  if (!isReference) {
+    if (meta) {
+      lines.push(`Workflow: ${sanitizeLine(meta.name)}`);
+      lines.push(sanitizeLine(meta.description));
+    } else {
+      lines.push("Workflow: (the script declares no meta block)");
+    }
+  } else if (provenance.kind === "extension") {
+    lines.push(`Extension workflow: ${sanitizeLine(provenance.workflow.name)}`);
+    lines.push(sanitizeLine(provenance.workflow.description));
+    lines.push(
+      "",
+      `Loaded from: ${sanitizeLine(params.scriptPath ?? loaded?.scriptPath ?? provenance.workflow.scriptPath)}`
+    );
   } else {
-    lines.push("Workflow: (the script declares no meta block)");
+    const label = provenance.kind === "generated" ? "Generated workflow script" : "Saved workflow";
+    lines.push(
+      `${label}: ${sanitizeLine(params.name || params.scriptPath || "")}`
+    );
+    if (meta) {
+      lines.push(`Workflow: ${sanitizeLine(meta.name)}`);
+      lines.push(sanitizeLine(meta.description));
+    }
+    if (params.name && loaded) {
+      lines.push("", `Loaded from: ${sanitizeLine(loaded.scriptPath)}`);
+    }
+  }
+  if (loadError !== void 0) {
+    lines.push("", `Cannot load the script: ${sanitizeLine(loadError)}`);
   }
   if (meta?.phases?.length) {
     const shown = meta.phases.slice(0, CONFIRM_MAX_PHASES);
@@ -1049,8 +1270,12 @@ function buildConfirmationPrompt(params, meta, isGeneratedScriptPath) {
       lines.push(`  \u2026 and ${meta.phases.length - shown.length} more`);
     }
   }
-  if (params.scriptPath && meta) {
-    lines.push("", `Loaded from: ${sanitizeLine(params.scriptPath)}`);
+  const structureSource = params.script || loaded?.script;
+  if (structureSource) {
+    const structure = buildConfirmationStructure(structureSource);
+    if (structure.length > 0) {
+      lines.push("", CONFIRM_STRUCTURE_HEADING, ...structure);
+    }
   }
   if (params.resumeFromRunId) {
     lines.push("", `Resuming run: ${sanitizeLine(params.resumeFromRunId)}`);
@@ -1067,26 +1292,67 @@ function buildConfirmationPrompt(params, meta, isGeneratedScriptPath) {
       `Args: ${clampForDisplay(sanitizeLine(rendered), CONFIRM_ARGS_CHARS)}`
     );
   }
-  if (params.script) {
+  const scriptText = params.script || loaded?.script;
+  if (scriptText) {
     lines.push(
       "",
-      "Script:",
-      clampForDisplay(
-        sanitizeBlock(params.script),
-        CONFIRM_SCRIPT_EXCERPT_CHARS
-      )
+      loaded ? `Script (${WORKFLOW_RULE_DIGEST_KEY} ${loaded.digest}):` : "Script:",
+      clampForDisplay(sanitizeBlock(scriptText), CONFIRM_SCRIPT_EXCERPT_CHARS)
     );
   }
   return lines.join("\n");
 }
 __name(buildConfirmationPrompt, "buildConfirmationPrompt");
-function buildUsageBanner(total) {
-  if (total === null) {
-    return `> Workflows have no per-run token cap. Set \`${MAX_TOKENS_PER_WORKFLOW_ENV}=<n>\` (env) for a soft cap. Suppress this notice with \`skipWorkflowUsageWarning: true\` in settings.
+function buildConfirmationStructure(script) {
+  const shape = scanWorkflowScriptShape(script);
+  const shown = shape.rows.slice(0, CONFIRM_MAX_STRUCTURE_ROWS);
+  const lines = shown.map((row) => {
+    const label = row.kind === "loop" ? `loop ${sanitizeLine(row.condition ?? "")}` : row.kind;
+    if (row.count === 0) {
+      return `  ${label} \u2014 runs functions built elsewhere in the script`;
+    }
+    const sites = row.count > 1 ? `, ${row.count} agent() call sites` : "";
+    const prompts = row.prompts.map((prompt) => `"${sanitizeLine(prompt)}"`).join(", ");
+    return prompts ? `  ${label}${sites} \u2014 ${prompts}` : `  ${label}${sites}`;
+  });
+  if (shape.rows.length > shown.length) {
+    lines.push(`  \u2026 and ${shape.rows.length - shown.length} more`);
+  }
+  return lines;
+}
+__name(buildConfirmationStructure, "buildConfirmationStructure");
+var WORKFLOW_RULE_DIGEST_KEY = "sha256";
+function describeLoadError(load) {
+  if (load.ok) return "";
+  return load.error instanceof Error ? load.error.message : String(load.error);
+}
+__name(describeLoadError, "describeLoadError");
+async function unwrapScriptLoad(load) {
+  const settled = await load;
+  if (settled.ok) return settled.loaded;
+  throw settled.error;
+}
+__name(unwrapScriptLoad, "unwrapScriptLoad");
+function buildWorkflowGrantRule(params, digest) {
+  const [key, value] = params.name ? ["name", params.name] : ["scriptPath", params.scriptPath];
+  if (!value || /[,*]/.test(value) || value.trim() !== value) {
+    return void 0;
+  }
+  return `${getRuleDisplayName(resolveToolName(ToolNames.WORKFLOW))}(${key}:${value},${WORKFLOW_RULE_DIGEST_KEY}:${digest})`;
+}
+__name(buildWorkflowGrantRule, "buildWorkflowGrantRule");
+function buildUsageBanner(budget) {
+  if (budget.total === null) {
+    return `> Workflows have no per-run token cap. Put a \`+500k\`-style target in your message to cap a turn, or set \`${MAX_TOKENS_PER_WORKFLOW_ENV}=<n>\` (env) for a per-run soft cap. Suppress this notice with \`skipWorkflowUsageWarning: true\` in settings.
 
 `;
   }
-  return `> Workflow token cap is ${total} (per \`${MAX_TOKENS_PER_WORKFLOW_ENV}\`). Suppress this notice with \`skipWorkflowUsageWarning: true\` in settings.
+  if (budget.source === "directive") {
+    return `> This turn's output-token target is ${budget.total}` + (budget.directiveText ? ` (set by \`${budget.directiveText}\` in your message)` : "") + `; workflow agent() calls stop once the turn's spend reaches it. Suppress this notice with \`skipWorkflowUsageWarning: true\` in settings.
+
+`;
+  }
+  return `> Workflow token cap is ${budget.total} (per \`${MAX_TOKENS_PER_WORKFLOW_ENV}\`). Suppress this notice with \`skipWorkflowUsageWarning: true\` in settings.
 
 `;
 }
@@ -1140,8 +1406,8 @@ Do not call this tool unless the user has asked for multi-agent orchestration. A
 
 - The user's message contains the word \`workflow\`; a system reminder confirms it when it does.
 - The user asked for orchestration in their own words \u2014 run a workflow, fan out agents, orchestrate this with subagents.
-- A skill or slash command the user invoked instructs you to use this tool.
-- The user named a saved workflow to run, reached through \`workflow('<name>')\` or \`scriptPath\`.
+- A skill or slash command that ran \u2014 invoked by the user, or by you through the Skill tool \u2014 instructs you to use this tool.
+- The user named a saved workflow to run, reached through \`name\`, \`workflow('<name>')\` or \`scriptPath\`.
 - The user asked to resume or continue an earlier run, which is \`resumeFromRunId\`.
 
 Otherwise do not call it, however well the task would parallelize. Do the work in the main loop, or spawn a single subagent for one self-contained piece. When a workflow would genuinely be the better tool, say in one sentence what it would fan out over and roughly how many agents that is, then let the user decide \u2014 and mention that including the word \`workflow\` next time skips the ask.
@@ -1151,16 +1417,20 @@ Otherwise do not call it, however well the task would parallelize. Do the work i
 Reach for one to be comprehensive (cover every part of the work in parallel), to be confident (independent perspectives and adversarial checks before an answer is committed to), or to take on scale a single context cannot hold. Parallelism on its own is not a reason; work that is already one short sequence of edits belongs in the main loop.`;
 var WORKFLOW_TOOL_RUNTIME = `**Runtime**
 
-\`phase(title)\`, \`log(msg)\`, \`agent(prompt, opts?)\`, \`parallel(thunks)\`, \`pipeline(items, ...stages)\`, \`workflow(nameOrRef, args?)\`, plus the \`args\` and \`budget\` globals. Saved workflows are \`<name>.js\` files under \`<projectRoot>/.qwen/workflows\` (project scope, also surfaced as \`/<name>\` slash commands) or \`~/.qwen/workflows\` (user scope); \`scriptPath\` additionally accepts a path inside the generated-scripts root (\`$QWEN_CODE_PROJECT_DIR/workflows/generated\` \u2014 the per-project runtime dir, not the project tree), and a path outside those roots is refused. Default \`max(2, min(16, availableParallelism()-2))\` agents in flight per run, which follows CPU affinity and container CPU limits (\`${MAX_WORKFLOW_CONCURRENCY_ENV}\`), up to ${DEFAULT_MAX_AGENTS_PER_RUN} agents total (\`${MAX_WORKFLOW_AGENTS_ENV}\`), under a 30-minute wall-clock cap per run (\`QWEN_CODE_MAX_WORKFLOW_SECONDS\`) \u2014 a fan-out near the agent cap will not fit inside the default cap. Each subagent attempt is separately capped at ${DEFAULT_WORKFLOW_SUBAGENT_MAX_TURNS} turns (\`${WORKFLOW_SUBAGENT_MAX_TURNS_ENV}\`) and ${DEFAULT_WORKFLOW_SUBAGENT_MAX_TIME_MINUTES} minutes (\`${WORKFLOW_SUBAGENT_MAX_MINUTES_ENV}\`). \`agent()\` resolves to \`null\` when that admitted agent fails on its own \u2014 turn/time caps, model or setup errors, missing structured output, exhausted stall retries \u2014 for a bare \`await agent()\` exactly as inside \`parallel()\`/\`pipeline()\`, so check for \`null\` wherever you read a result; run-level rejections no later call could survive (the token budget, the ${DEFAULT_MAX_AGENTS_PER_RUN}-agent cap, cancellation) throw instead. Every run hands back its runId, the script's path on disk (an inline script is persisted, so a resume edits that file rather than re-sending the source) and its journal path; read it before diagnosing an empty or surprising result. Runs appear in the background-tasks view and the \`/workflows\` dialog (live phase tree, token usage, cooperative pause/resume, cancel); \`run_in_background: true\` returns a run handle immediately in the interactive TUI and delivers completion through the conversation. Scripts run in a node:vm sandbox with no filesystem or shell access \u2014 all I/O happens through the spawned agents.`;
+\`phase(title)\`, \`log(msg)\`, \`agent(prompt, opts?)\`, \`parallel(thunks)\`, \`pipeline(items, ...stages)\`, \`workflow(nameOrRef, args?)\`, plus the \`args\` and \`budget\` globals. Saved workflows are \`<name>.js\` files under \`<projectRoot>/.qwen/workflows\` (project scope, also surfaced as \`/<name>\` slash commands) or \`~/.qwen/workflows\` (user scope), plus active extensions' \`<extension>:<name>\`; \`scriptPath\` additionally accepts an active extension's workflow file or a path inside the generated-scripts root (\`$QWEN_CODE_PROJECT_DIR/workflows/generated\` \u2014 the per-project runtime dir, not the project tree); any other path is refused. Default \`max(2, min(16, availableParallelism()-2))\` agents in flight per run, which follows CPU affinity and container CPU limits (\`${MAX_WORKFLOW_CONCURRENCY_ENV}\`), up to ${DEFAULT_MAX_AGENTS_PER_RUN} agents total (\`${MAX_WORKFLOW_AGENTS_ENV}\`), under a 30-minute wall-clock cap per run (\`QWEN_CODE_MAX_WORKFLOW_SECONDS\`) \u2014 a fan-out near the agent cap will not fit inside the default cap. Each subagent attempt is separately capped at ${DEFAULT_WORKFLOW_SUBAGENT_MAX_TURNS} turns (\`${WORKFLOW_SUBAGENT_MAX_TURNS_ENV}\`) and ${DEFAULT_WORKFLOW_SUBAGENT_MAX_TIME_MINUTES} minutes (\`${WORKFLOW_SUBAGENT_MAX_MINUTES_ENV}\`). \`agent()\` resolves to \`null\` when that admitted agent fails on its own \u2014 turn/time caps, model or setup errors, missing structured output, exhausted stall retries \u2014 for a bare \`await agent()\` exactly as inside \`parallel()\`/\`pipeline()\`, so check for \`null\` wherever you read a result; run-level rejections no later call could survive (the token budget, the ${DEFAULT_MAX_AGENTS_PER_RUN}-agent cap, cancellation) throw instead. \`budget.total\` is the turn's output-token target when the user's message sets one with a \`+500k\`-style directive, and \`budget.spent()\` then counts every output token this turn, the main loop included. Every run hands back its runId, the script's path on disk (an inline script is persisted, so a resume edits that file rather than re-sending the source) and its journal path; read it before diagnosing an empty or surprising result. Runs appear in the background-tasks view and the \`/workflows\` dialog (live phase tree, token usage, cooperative pause/resume, cancel); \`run_in_background: true\` returns a run handle immediately in the interactive TUI and delivers completion through the conversation. Scripts run in a node:vm sandbox with no filesystem or shell access \u2014 all I/O happens through the spawned agents.`;
 var WORKFLOW_AUTHORING_POINTER = `**Writing the script**
 
 Before writing a script, load the \`${WORKFLOW_AUTHORING_SKILL_NAME}\` skill \u2014 the authoring reference: the sandbox contract, agent() options, \`pipeline()\` vs \`parallel()\`, verification and convergence patterns, resume, and a worked example.`;
 var WORKFLOW_AUTHORING_TOOL_SEARCH_NOTE = ` ${toolSearchRevealSentence(ToolDisplayNames.SKILL)}`;
 var WORKFLOW_AUTHORING_INLINE_NOTE = "Skills cannot be loaded in this session, even one named in a skill listing, so the authoring reference follows in full. Where it points at another skill, that skill is not available here either.";
-function buildWorkflowToolDescription(surface, reference = readWorkflowAuthoringReference()) {
+function buildWorkflowToolDescription(surface, reference = readWorkflowAuthoringReference(), sizeGuideline = null) {
+  const size = sizeGuideline ? buildWorkflowSizeGuidelineParagraph(sizeGuideline) : null;
+  const runtime = size ? `${WORKFLOW_TOOL_RUNTIME}
+
+${size}` : WORKFLOW_TOOL_RUNTIME;
   const pointer = `${WORKFLOW_TOOL_DECISION}
 
-${WORKFLOW_TOOL_RUNTIME}
+${runtime}
 
 ${WORKFLOW_AUTHORING_POINTER}`;
   switch (surface) {
@@ -1171,11 +1441,13 @@ ${WORKFLOW_AUTHORING_POINTER}`;
     case "withheld":
       return `${WORKFLOW_TOOL_DECISION}
 
-${WORKFLOW_TOOL_RUNTIME}`;
+${runtime}`;
     case "inline":
       return reference ? `${WORKFLOW_TOOL_DECISION}
 
-${WORKFLOW_AUTHORING_INLINE_NOTE}
+${size ? `${size}
+
+` : ""}${WORKFLOW_AUTHORING_INLINE_NOTE}
 
 ---
 
@@ -1237,7 +1509,11 @@ var WorkflowTool = class extends BaseDeclarativeTool {
     super(
       ToolNames.WORKFLOW,
       ToolDisplayNames.WORKFLOW,
-      buildWorkflowToolDescription(surface),
+      buildWorkflowToolDescription(
+        surface,
+        void 0,
+        config.getWorkflowSizeGuideline?.() ?? resolveWorkflowSizeGuidelineSetting(void 0)
+      ),
       "other" /* Other */,
       buildWorkflowParamSchema(surface),
       /* isOutputMarkdown */
@@ -1278,13 +1554,20 @@ var WorkflowTool = class extends BaseDeclarativeTool {
     );
   }
   validateToolParamValues(params) {
+    try {
+      readWorkflowSourceRef(params.sourceRef);
+    } catch (error) {
+      return error instanceof Error ? error.message : "Invalid workflow sourceRef.";
+    }
     const hasScript = typeof params.script === "string" && params.script.length > 0;
     const hasPath = typeof params.scriptPath === "string" && params.scriptPath.length > 0;
-    if (!hasScript && !hasPath) {
-      return "WorkflowTool: provide `script` (inline source) or `scriptPath` (a workflow script file).";
+    const hasName = typeof params.name === "string" && params.name.length > 0;
+    const sources = [hasScript, hasPath, hasName].filter(Boolean).length;
+    if (sources === 0) {
+      return "WorkflowTool: provide `script` (inline source), `scriptPath` (a workflow script file) or `name` (a saved workflow).";
     }
-    if (hasScript && hasPath) {
-      return "WorkflowTool: provide exactly one of `script` or `scriptPath`, not both.";
+    if (sources > 1) {
+      return "WorkflowTool: provide exactly one of `script`, `scriptPath` or `name`.";
     }
     if (params.resumeFromRunId !== void 0 && !/^wf_[0-9a-f]+$/.test(params.resumeFromRunId)) {
       return "WorkflowTool: `resumeFromRunId` must match the generated id format `wf_<hex>`.";