@runcofactor/cli 0.10.0 → 0.13.0

package/dist/{chunk-N7HFALX3.js → chunk-VGTKUOYS.js}

@@ -1,7 +1,7 @@
 import { createRequire as __cr } from "module"; const require = __cr(import.meta.url);
 import {
   packageName
-} from "./chunk-JICSYFRJ.js";
+} from "./chunk-JZMJUPZP.js";
 
 // src/update-check.ts
 import fs from "fs/promises";
@@ -85,4 +85,4 @@ export {
   checkForUpdate,
   clearUpdateCache
 };
-//# sourceMappingURL=chunk-N7HFALX3.js.map
+//# sourceMappingURL=chunk-VGTKUOYS.js.map

package/dist/{chunk-B2VISN2V.js → chunk-YN763NWQ.js}

@@ -1,7 +1,7 @@
 import { createRequire as __cr } from "module"; const require = __cr(import.meta.url);
 import {
   InlineAssertionSchema
-} from "./chunk-SJJW77WN.js";
+} from "./chunk-QGI4UCJX.js";
 
 // ../canary-spec/src/parse.ts
 import yaml from "yaml";
@@ -26,7 +26,9 @@ var FrontmatterSchema = z.object({
    * create. On recompile, the compiler keys the diff on this ID.
    */
   workflowId: z.string().uuid().optional(),
-  status: z.enum(["draft", "published"]).optional(),
+  // 'published' is a deprecated legacy value (pre approval/promotion split);
+  // accepted for old spec files and normalized to 'draft'.
+  status: z.enum(["draft", "approved", "published"]).transform((s) => s === "published" ? "draft" : s).optional(),
   flowType: z.enum(["standard", "setup", "seed", "teardown"]).optional(),
   /**
    * Credential the journey runs as. Required for authenticated specs (the
@@ -41,7 +43,7 @@ var FrontmatterSchema = z.object({
   sandboxTemplate: z.string().optional(),
   environments: z.union([
     z.object({ only: z.array(z.string()).min(1) }),
-    z.object({ types: z.array(z.enum(["permanent", "ephemeral", "local"])).min(1) })
+    z.object({ types: z.array(z.enum(["permanent", "ephemeral", "local", "sandbox"])).min(1) })
   ]).optional(),
   /**
    * Teardown linkage for `flowType: seed` workflows. Two surface forms:
@@ -145,7 +147,7 @@ var ActionNodeSchema = NodeBase.extend({
 var AssertionNodeSchema = NodeBase.extend({
   kind: z.literal("assertion"),
   condition: z.string().min(1),
-  severity: z.enum(["warn", "fail"]).default("warn"),
+  severity: z.enum(["warn", "fail", "fatal"]).default("fatal"),
   expectedOutcome: z.string().optional(),
   alwaysUseAgent: z.boolean().optional()
 });
@@ -158,7 +160,14 @@ var SeedNodeSchema = NodeBase.extend({
   /** Per-request timeout (seconds) for the seed/teardown api_sequence calls (API mode only). */
   apiTimeoutSeconds: z.number().int().positive().optional(),
   scope: z.enum(["inline", "suite"]).optional(),
-  runTeardown: z.boolean().optional()
+  runTeardown: z.boolean().optional(),
+  /**
+   * Per-node overrides for the seed flow's `kind: 'value'` workflow inputs,
+   * keyed by input name. Only honored for inline-scoped seeds — suite-scoped
+   * seeds run with the seed flow's input defaults. Spec syntax:
+   * `- input.<name>: <value>` sub-bullets.
+   */
+  inputs: z.record(z.string(), z.string()).optional()
 });
 var SetupNodeSchema = NodeBase.extend({
   kind: z.literal("setup"),
@@ -195,7 +204,10 @@ var AudioPlayNodeSchema = NodeBase.extend({
 var AudioAssertionNodeSchema = NodeBase.extend({
   kind: z.literal("audioAssertion"),
   label: z.string().min(1),
-  severity: z.enum(["warn", "fail"]).default("fail"),
+  // Audio default stays 'fail' (not 'fatal' like standalone assertions):
+  // audio assertions never halt mid-run, so fail ≈ fatal here and fail is the
+  // historical default.
+  severity: z.enum(["warn", "fail", "fatal"]).default("fail"),
   prompt: z.string().optional(),
   model: z.enum(["gpt-audio", "gemini-2.x"]).optional(),
   minDurationMs: z.number().int().nonnegative().optional(),
@@ -221,6 +233,21 @@ var ApiSequenceNodeSchema = NodeBase.extend({
    */
   sidecar: z.string().min(1).optional()
 });
+var SandboxActionNodeSchema = NodeBase.extend({
+  kind: z.literal("sandboxAction"),
+  /** Slug of the sandbox action; resolved against the run env's template at run time. */
+  actionSlug: z.string().min(1),
+  /** Cosmetic display label. */
+  label: z.string().optional(),
+  /** Input params; values may carry `$var.*` / macro tokens (passed verbatim). */
+  params: z.record(z.string(), z.string()).optional(),
+  /**
+   * Output variable keys the action produces (denormalized from its
+   * outputSchema). Optional — compile resolves them from the action when
+   * omitted and a verified template declares the slug.
+   */
+  outputs: z.array(z.string().min(1)).optional()
+});
 var EndNodeSchema = NodeBase.extend({
   kind: z.literal("end"),
   outcome: z.enum(["pass", "fail"]).default("pass")
@@ -238,6 +265,7 @@ var JourneyNodeSchema = z.union([
   AudioPlayNodeSchema,
   AudioAssertionNodeSchema,
   ApiSequenceNodeSchema,
+  SandboxActionNodeSchema,
   EndNodeSchema
 ]);
 var SpecAstSchema = z.object({
@@ -604,6 +632,7 @@ function parseJourneyBlock(lines, start, end, baseIndent, startLine, issues) {
       const subBullets = readBullets(lines, i + 1 + descLineCount, end, baseIndent);
       consumedMain += subBullets.consumed;
       const opts = parseKvBullets(subBullets.bullets);
+      const inputs = parseSeedInputBullets(subBullets.bullets);
       nodes.push({
         ...idMeta,
         kind: "seed",
@@ -614,7 +643,8 @@ function parseJourneyBlock(lines, start, end, baseIndent, startLine, issues) {
         mode: opts.mode,
         apiTimeoutSeconds: opts.apiTimeoutSeconds === void 0 ? void 0 : Number(opts.apiTimeoutSeconds),
         scope: opts.scope,
-        runTeardown: typeof opts.runTeardown === "string" ? opts.runTeardown !== "false" : void 0
+        runTeardown: typeof opts.runTeardown === "string" ? opts.runTeardown !== "false" : void 0,
+        inputs
       });
       i += consumedMain;
       continue;
@@ -683,7 +713,7 @@ function parseJourneyBlock(lines, start, end, baseIndent, startLine, issues) {
         kind: "assertion",
         condition: stripPunctuation(condition),
         description,
-        severity: opts.severity ?? "warn",
+        severity: opts.severity ?? "fatal",
         expectedOutcome: typeof opts.expectedOutcome === "string" ? opts.expectedOutcome : void 0,
         alwaysUseAgent: opts.alwaysUseAgent === "true" ? true : void 0
       });
@@ -728,6 +758,26 @@ function parseJourneyBlock(lines, start, end, baseIndent, startLine, issues) {
       i += consumedMain;
       continue;
     }
+    if (lower.startsWith("sandbox action")) {
+      const slug = stripPunctuation(
+        leadIn.replace(/^sandbox action\s*[—-]\s*/i, "").trim() || remainder
+      );
+      const subBullets = readBullets(lines, i + 1 + descLineCount, end, baseIndent);
+      consumedMain += subBullets.consumed;
+      const opts = parseKvBullets(subBullets.bullets);
+      const params = parseActionParamBullets(subBullets.bullets);
+      nodes.push({
+        ...idMeta,
+        kind: "sandboxAction",
+        actionSlug: slug,
+        description,
+        label: typeof opts.label === "string" ? opts.label : void 0,
+        params,
+        outputs: typeof opts.outputs === "string" ? opts.outputs.split(",").map((s) => s.trim()).filter((s) => s.length > 0) : void 0
+      });
+      i += consumedMain;
+      continue;
+    }
     if (lower.startsWith("api sequence")) {
       const title = leadIn.replace(/^api sequence\s*[—-]\s*/i, "").trim();
       const subBullets = readBullets(lines, i + 1 + descLineCount, end, baseIndent);
@@ -847,10 +897,11 @@ function parseActionBullets(bullets, lineNo, issues) {
   let captureExtraMs;
   let alwaysUseAgent;
   for (const b of bullets) {
-    const fieldM = /^field\s+(?:"([^"]+)"|([A-Za-z0-9_-]+))\s*(?:\(([^)]+)\))?\s*:\s*(.+)$/i.exec(b);
+    const fieldM = /^field\s+(?:"([^"]+)"|(.+?))\s*(?:\(([^)]+)\))?\s*:\s*(.+)$/i.exec(b);
     if (fieldM) {
+      const name = (fieldM[1] ?? fieldM[2] ?? "").trim();
       fields.push({
-        name: fieldM[1] ?? fieldM[2],
+        name,
         type: fieldM[3],
         value: stripQuotes(fieldM[4].trim())
       });
@@ -864,7 +915,7 @@ function parseActionBullets(bullets, lineNo, issues) {
     const assertM = /^assert\s*\(([^)]+)\)\s*:\s*(.+)$/i.exec(b);
     if (assertM) {
       const flags = assertM[1].split(",").map((s) => s.trim().toLowerCase());
-      const severity = flags.includes("fail") ? "fail" : "warn";
+      const severity = flags.includes("fatal") ? "fatal" : flags.includes("fail") ? "fail" : flags.includes("warn") ? "warn" : "fatal";
       const agentic = flags.includes("agentic") || void 0;
       assertions.push({ condition: stripQuotes(assertM[2].trim()), severity, agentic });
       continue;
@@ -893,6 +944,26 @@ function parseKvBullets(bullets) {
   }
   return out;
 }
+function parseSeedInputBullets(bullets) {
+  let out;
+  for (const b of bullets) {
+    const m = /^input\.([A-Za-z_][A-Za-z0-9_]*)\s*:\s*(.+)$/.exec(b);
+    if (!m) continue;
+    out ??= {};
+    out[m[1]] = stripQuotes(m[2].trim());
+  }
+  return out;
+}
+function parseActionParamBullets(bullets) {
+  let out;
+  for (const b of bullets) {
+    const m = /^param\.([A-Za-z_][A-Za-z0-9_]*)\s*:\s*(.+)$/.exec(b);
+    if (!m) continue;
+    out ??= {};
+    out[m[1]] = stripQuotes(m[2].trim());
+  }
+  return out;
+}
 function numOpt(v) {
   if (v === void 0) return void 0;
   const n = Number(v);
@@ -923,17 +994,18 @@ var RESERVED_MACROS = /* @__PURE__ */ new Set([
 ]);
 function lintSpec(ast) {
   const issues = [];
+  const isRunFailing = (severity) => severity === "fail" || severity === "fatal";
   const hasFailAssertion = anyNode(ast.journey, (n) => {
-    if (n.kind === "action") return n.assertions.some((a) => a.severity === "fail");
-    if (n.kind === "assertion") return n.severity === "fail";
-    if (n.kind === "audioAssertion") return n.severity === "fail";
+    if (n.kind === "action") return n.assertions.some((a) => isRunFailing(a.severity));
+    if (n.kind === "assertion") return isRunFailing(n.severity);
+    if (n.kind === "audioAssertion") return isRunFailing(n.severity);
     return false;
   });
   if (!hasFailAssertion) {
     issues.push({
       severity: "warn",
-      message: "Spec has no fail-severity assertions \u2014 the case will pass even if the feature is broken.",
-      hint: "Add `- assert (fail): \u2026` under at least one action."
+      message: "Spec has no fail- or fatal-severity assertions \u2014 the case will pass even if the feature is broken.",
+      hint: "Add `- assert (fail): \u2026` (or `(fatal)` for must-stop preconditions) under at least one action."
     });
   }
   if (!ast.frontmatter.requirementRef) {
@@ -944,6 +1016,7 @@ function lintSpec(ast) {
   }
   const declaredInputs = new Set(ast.inputs.map((i) => i.name));
   const promotedVars = /* @__PURE__ */ new Set();
+  declaredInputs.forEach((input) => promotedVars.add(input));
   walkNodes(ast.journey, (n) => {
     if (n.kind === "action") {
       n.capture.forEach((c) => promotedVars.add(c));
@@ -958,7 +1031,7 @@ function lintSpec(ast) {
         if (!promotedVars.has(name)) {
           issues.push({
             severity: "warn",
-            message: `\`$var.${name}\` referenced in ${ctx} but not declared via \`- capture:\` or a field.`,
+            message: `\`$var.${name}\` referenced in ${ctx} but not declared in \`## Inputs\`, via \`- capture:\`, or as a field.`,
             hint: "If this is authored data, add `- capture: " + name + "` to the action that produces it."
           });
         }
@@ -1086,11 +1159,29 @@ function extractMacroRefs(s) {
   return out;
 }
 
+// ../canary-spec/src/input-refs.ts
+function normalizeDeclaredInputReferences(value, inputNames) {
+  if (inputNames.size === 0 || !value.includes("$")) return value;
+  return value.replace(
+    /(^|[^\\])\$([A-Za-z_][A-Za-z0-9_-]*)/g,
+    (match, prefix, name, offset, full) => {
+      if (!inputNames.has(name)) return match;
+      const next = full[offset + match.length];
+      const afterDot = full[offset + match.length + 1];
+      if (next === "." && afterDot !== void 0 && /[A-Za-z0-9_-]/.test(afterDot)) {
+        return match;
+      }
+      return `${prefix}$var.${name}`;
+    }
+  );
+}
+
 // ../canary-spec/src/emit.ts
 function emitSpec(ast, opts = {}) {
   const { appendDefaultEnd = true } = opts;
   const nodes = [];
-  for (const n of ast.journey) emitNode(n, nodes);
+  const inputNames = new Set(ast.inputs.map((i) => i.name));
+  for (const n of ast.journey) emitNode(n, nodes, inputNames);
   if (ast.frontmatter.authenticated) {
     let insertAt = 0;
     while (insertAt < nodes.length && (nodes[insertAt].nodeType === "seed" || nodes[insertAt].nodeType === "setup")) {
@@ -1214,24 +1305,27 @@ function loginConfig(ref, opts) {
     ...performLogin ? { performLogin: true } : {}
   };
 }
-function emitNode(n, out) {
+function emitNode(n, out, inputNames) {
+  const inputRef = (value) => normalizeDeclaredInputReferences(value, inputNames);
   const meta = {
     ...n.nodeId ? { nodeId: n.nodeId } : {},
     ...n.sourceLine !== void 0 ? { sourceLine: n.sourceLine } : {}
   };
   switch (n.kind) {
-    case "navigate":
+    case "navigate": {
+      const pageUrl = inputRef(n.pageUrl);
       out.push({
         ...meta,
         nodeType: "navigate",
         configJson: {
-          title: `Go to ${shortPath(n.pageUrl)}`,
-          description: n.description ?? `Navigate to ${n.pageUrl}`,
-          pageUrl: n.pageUrl,
+          title: `Go to ${shortPath(pageUrl)}`,
+          description: inputRef(n.description ?? `Navigate to ${pageUrl}`),
+          pageUrl,
           ...n.openInNewTab ? { openInNewTab: true } : {}
         }
       });
       return;
+    }
     case "switchRole": {
       const ref = n.credentialRef;
       const fallbackDesc = ref.kind === "credential" ? `Re-authenticate as ${ref.name}` : ref.kind === "seedOutput" ? `Re-authenticate as seed-provisioned ${ref.ref}` : `Re-authenticate as ${ref.role}`;
@@ -1240,7 +1334,7 @@ function emitNode(n, out) {
         nodeType: "login",
         configJson: loginConfig(ref, {
           titlePrefix: "Switch role to",
-          description: n.description ?? fallbackDesc,
+          description: inputRef(n.description ?? fallbackDesc),
           performLogin: true
         })
       });
@@ -1251,7 +1345,7 @@ function emitNode(n, out) {
         name: f.name,
         label: humanizeLabel(f.name),
         type: f.type ?? "text",
-        value: f.value
+        value: inputRef(f.value)
       }));
       const inputValues = fieldEntries.length > 0 ? Object.fromEntries(
         fieldEntries.filter((f) => f.value !== void 0 && f.value !== "").map((f) => [f.name, f.value])
@@ -1260,8 +1354,8 @@ function emitNode(n, out) {
         ...meta,
         nodeType: "action",
         configJson: {
-          customActionTitle: n.title,
-          actionDescription: n.description ?? n.title,
+          customActionTitle: inputRef(n.title),
+          actionDescription: inputRef(n.description ?? n.title),
           ...fieldEntries.length > 0 ? {
             formFields: fieldEntries,
             dataRequirements: fieldEntries.map(({ name, label, type }) => ({
@@ -1275,7 +1369,7 @@ function emitNode(n, out) {
           ...n.capture.length > 0 ? { declaredOutputs: n.capture } : {},
           ...n.assertions.length > 0 ? {
             inlineAssertions: n.assertions.map((a) => ({
-              condition: a.condition,
+              condition: inputRef(a.condition),
               severity: a.severity,
               ...a.agentic ? { agentic: true } : {}
             }))
@@ -1296,8 +1390,8 @@ function emitNode(n, out) {
         nodeType: "assertion",
         configJson: {
           title: "Assert",
-          description: n.description ?? n.condition,
-          condition: n.condition,
+          description: inputRef(n.description ?? n.condition),
+          condition: inputRef(n.condition),
           severity: n.severity,
           ...n.expectedOutcome ? { expectedOutcome: n.expectedOutcome } : {},
           ...n.alwaysUseAgent ? { alwaysUseAgent: true } : {}
@@ -1323,7 +1417,10 @@ function emitNode(n, out) {
           ...n.mode ? { executionMode: n.mode } : {},
           ...n.apiTimeoutSeconds ? { apiTimeoutSeconds: n.apiTimeoutSeconds } : {},
           ...n.scope ? { scope: n.scope } : {},
-          ...n.runTeardown !== void 0 ? { runTeardown: n.runTeardown } : {}
+          ...n.runTeardown !== void 0 ? { runTeardown: n.runTeardown } : {},
+          // Spec `inputs` → runtime config key `inputValues` (same remap
+          // convention as the other canonical-key mappings above).
+          ...n.inputs && Object.keys(n.inputs).length > 0 ? { inputValues: n.inputs } : {}
         }
       });
       return;
@@ -1359,26 +1456,26 @@ function emitNode(n, out) {
         nodeType: "condition",
         configJson: {
           title: "If",
-          description: n.description ?? n.expression,
+          description: inputRef(n.description ?? n.expression),
           // Canonical runtime key is `conditionDescription`.
-          conditionDescription: n.expression,
-          ...n.hints ? { evaluationHints: n.hints } : {}
+          conditionDescription: inputRef(n.expression),
+          ...n.hints ? { evaluationHints: inputRef(n.hints) } : {}
         }
       });
-      n.thenBranch.forEach((c) => emitNode(c, out));
-      n.elseBranch.forEach((c) => emitNode(c, out));
+      n.thenBranch.forEach((c) => emitNode(c, out, inputNames));
+      n.elseBranch.forEach((c) => emitNode(c, out, inputNames));
       return;
     case "notification":
       out.push({
         ...meta,
         nodeType: "notification",
         configJson: {
-          title: `Notify ${n.to}`,
-          description: n.description ?? n.body,
+          title: `Notify ${inputRef(n.to)}`,
+          description: inputRef(n.description ?? n.body),
           channel: n.channel,
-          to: n.to,
-          body: n.body,
-          ...n.subject ? { subject: n.subject } : {},
+          to: inputRef(n.to),
+          body: inputRef(n.body),
+          ...n.subject ? { subject: inputRef(n.subject) } : {},
           ...n.attach ? { attachmentRef: n.attach } : {}
         }
       });
@@ -1403,10 +1500,15 @@ function emitNode(n, out) {
         nodeType: "audio-assertion",
         configJson: {
           title: `Assert audio: ${n.label}`,
-          description: n.description ?? n.label,
+          description: inputRef(n.description ?? n.label),
           label: n.label,
           severity: n.severity,
-          ...n.prompt ? { naturalLanguage: { prompt: n.prompt, ...n.model ? { model: n.model } : {} } } : {},
+          ...n.prompt ? {
+            naturalLanguage: {
+              prompt: inputRef(n.prompt),
+              ...n.model ? { model: n.model } : {}
+            }
+          } : {},
           ...hasDeterministicAudioAssertion(n) ? {
             deterministic: {
               ...n.minDurationMs !== void 0 ? { minDurationMs: n.minDurationMs } : {},
@@ -1425,9 +1527,9 @@ function emitNode(n, out) {
         ...meta,
         nodeType: "api_sequence",
         configJson: {
-          customActionTitle: n.title,
-          description: n.description ?? n.title,
-          apiEndpointContext: n.apiEndpointContext,
+          customActionTitle: inputRef(n.title),
+          description: inputRef(n.description ?? n.title),
+          apiEndpointContext: inputRef(n.apiEndpointContext),
           ...n.credentialInputName ? { credentialInputName: n.credentialInputName } : {},
           // Sidecar reference is metadata for the CLI sync layer — runtime
           // ignores unknown configJson keys, and the node-hash projection
@@ -1437,6 +1539,22 @@ function emitNode(n, out) {
         }
       });
       return;
+    case "sandboxAction":
+      out.push({
+        ...meta,
+        nodeType: "sandbox_action",
+        configJson: {
+          title: n.label ?? `Sandbox action: ${n.actionSlug}`,
+          description: inputRef(n.description ?? n.label ?? n.actionSlug),
+          actionSlug: n.actionSlug,
+          ...n.label ? { actionLabel: n.label } : {},
+          // Param values pass through verbatim — $var.* / macro tokens resolve
+          // at run time against the execution state.
+          ...n.params && Object.keys(n.params).length > 0 ? { params: n.params } : {},
+          ...n.outputs && n.outputs.length > 0 ? { outputKeys: n.outputs } : {}
+        }
+      });
+      return;
     case "end":
       out.push({
         ...meta,
@@ -1523,7 +1641,9 @@ function authoredProjection(nodeType, raw) {
         onFailure: str(c.onFailure) ?? str(c.seedOnFailure) ?? null,
         executionMode: str(c.executionMode) ?? str(c.seedExecutionMode) ?? null,
         scope: str(c.scope) ?? null,
-        runTeardown: typeof c.runTeardown === "boolean" ? c.runTeardown : null
+        runTeardown: typeof c.runTeardown === "boolean" ? c.runTeardown : null,
+        // Input overrides change what the seed provisions — authored identity.
+        inputValues: seedInputValues(c)
       };
     case "setup":
       return {
@@ -1573,6 +1693,20 @@ function authoredProjection(nodeType, raw) {
     }
     case "api_sequence":
       return {};
+    case "sandbox_action": {
+      const params = obj(c.params) ?? {};
+      const paramEntries = {};
+      for (const key of Object.keys(params).sort()) {
+        paramEntries[key] = str(params[key]) ?? null;
+      }
+      const outputKeys = Array.isArray(c.outputKeys) ? c.outputKeys.filter((k) => typeof k === "string").sort() : [];
+      return {
+        actionSlug: str(c.actionSlug) ?? null,
+        label: str(c.actionLabel) ?? null,
+        params: paramEntries,
+        outputs: outputKeys
+      };
+    }
     case "end":
       return { outcome: str(c.outcome) ?? "pass" };
     default:
@@ -1638,6 +1772,13 @@ function trimText(v) {
 function str(v) {
   return typeof v === "string" ? v : void 0;
 }
+function seedInputValues(c) {
+  if (!c.inputValues || typeof c.inputValues !== "object") return null;
+  const entries = Object.entries(c.inputValues).filter(
+    (e) => typeof e[1] === "string"
+  );
+  return entries.length > 0 ? Object.fromEntries(entries) : null;
+}
 function num(v) {
   return typeof v === "number" && Number.isFinite(v) ? v : void 0;
 }
@@ -1978,6 +2119,8 @@ function reconcileLinearEdges(finalNodeIds, liveEdges) {
 function workflowToSpec(workflow, opts = {}) {
   const lines = [];
   const sorted = [...workflow.nodes].sort((a, b) => a.orderIndex - b.orderIndex);
+  const inputs = readInputs(workflow.inputsJson);
+  const inputNames = new Set(inputs.map((i) => i.name));
   let firstNonSeed = 0;
   while (firstNonSeed < sorted.length && (sorted[firstNonSeed].nodeType === "seed" || sorted[firstNonSeed].nodeType === "setup")) {
     firstNonSeed++;
@@ -1988,7 +2131,7 @@ function workflowToSpec(workflow, opts = {}) {
   lines.push("---");
   lines.push(`name: ${yamlScalar(workflow.name)}`);
   lines.push(`workflowId: ${workflow.id}`);
-  if (workflow.status === "draft" || workflow.status === "quarantined") {
+  if (workflow.status === "draft" || workflow.status === "approved") {
     lines.push(`status: ${workflow.status}`);
   }
   if (workflow.flowType && workflow.flowType !== "standard") {
@@ -2026,7 +2169,6 @@ function workflowToSpec(workflow, opts = {}) {
     lines.push(workflow.cleanup.trim());
     lines.push("");
   }
-  const inputs = readInputs(workflow.inputsJson);
   if (inputs.length > 0) {
     lines.push("## Inputs");
     for (const i of inputs) {
@@ -2072,7 +2214,7 @@ function workflowToSpec(workflow, opts = {}) {
   lines.push("");
   for (const node of sorted) {
     if (node === authLogin) continue;
-    const block = renderNode(node);
+    const block = renderNode(node, inputNames);
     if (block.length === 0) continue;
     block[0] = `${block[0]}   <!-- @id ${node.id} -->`;
     lines.push(...block);
@@ -2082,23 +2224,24 @@ function workflowToSpec(workflow, opts = {}) {
   lines.push("");
   return lines.join("\n");
 }
-function renderNode(node) {
+function renderNode(node, inputNames) {
   const c = node.configJson ?? {};
+  const inputRef = (value) => normalizeDeclaredInputReferences(value, inputNames);
   switch (node.nodeType) {
     case "login": {
       return [`**Switch role to ${renderLoginRef(c)}**`];
     }
     case "navigate":
-      return [`**Navigate to** \`${str2(c.pageUrl) ?? "/"}\`.`];
+      return [`**Navigate to** \`${inputRef(str2(c.pageUrl) ?? "/")}\`.`];
     case "action": {
-      const title = authoredActionTitle(c);
+      const title = inputRef(authoredActionTitle(c));
       const out = [`**Action \u2014 ${title}**`];
       const desc = str2(c.actionDescription);
-      if (desc && desc !== title) out.push(blockquote(desc));
+      if (desc && inputRef(desc) !== title) out.push(blockquote(inputRef(desc)));
       for (const f of authoredActionFields(c)) {
         const typeSuffix = f.type && f.type !== "text" ? ` (${f.type})` : "";
         const name = /^[A-Za-z0-9_-]+$/.test(f.name) ? f.name : `"${f.name}"`;
-        out.push(`- field ${name}${typeSuffix}: ${inputValue(f.value)}`);
+        out.push(`- field ${name}${typeSuffix}: ${inputValue(inputRef(f.value))}`);
       }
       for (const cap of arr2(c.declaredOutputs)) {
         if (typeof cap === "string") out.push(`- capture: ${cap}`);
@@ -2108,7 +2251,7 @@ function renderNode(node) {
         if (!cond) continue;
         const sev = str2(prop2(a, "severity")) ?? "fail";
         const flags = prop2(a, "agentic") === true ? `${sev}, agentic` : sev;
-        out.push(`- assert (${flags}): ${cond}`);
+        out.push(`- assert (${flags}): ${inputRef(cond)}`);
       }
       if (c.captureAudio === true) {
         out.push("- captureAudio: true");
@@ -2120,10 +2263,10 @@ function renderNode(node) {
       return out;
     }
     case "assertion": {
-      const cond = str2(c.condition) ?? "?";
+      const cond = inputRef(str2(c.condition) ?? "?");
       const out = [`**Assert** ${cond}`];
       const desc = str2(c.description);
-      if (desc && desc !== cond) out.push(blockquote(desc));
+      if (desc && inputRef(desc) !== cond) out.push(blockquote(inputRef(desc)));
       const severity = str2(c.severity) ?? (c.strict === true ? "fail" : "warn");
       out.push(`- severity: ${severity}`);
       if (str2(c.expectedOutcome)) out.push(`- expectedOutcome: ${str2(c.expectedOutcome)}`);
@@ -2141,6 +2284,11 @@ function renderNode(node) {
       if (mode) out.push(`- mode: ${mode}`);
       if (str2(c.scope)) out.push(`- scope: ${str2(c.scope)}`);
       if (typeof c.runTeardown === "boolean") out.push(`- runTeardown: ${c.runTeardown}`);
+      if (c.inputValues && typeof c.inputValues === "object") {
+        for (const [key, value] of Object.entries(c.inputValues)) {
+          if (typeof value === "string") out.push(`- input.${key}: ${value}`);
+        }
+      }
       return out;
     }
     case "setup": {
@@ -2156,14 +2304,15 @@ function renderNode(node) {
     }
     case "condition": {
       const expr = str2(c.conditionDescription) ?? str2(c.conditionExpression) ?? str2(c.description) ?? "?";
-      return expr.includes("\n") ? ["**If**", blockquote(expr)] : [`**If ${expr}**`];
+      const normalized = inputRef(expr);
+      return normalized.includes("\n") ? ["**If**", blockquote(normalized)] : [`**If ${normalized}**`];
     }
     case "notification": {
       const channel = str2(c.channel) ?? "email";
-      const to = str2(c.to) ?? "?";
+      const to = inputRef(str2(c.to) ?? "?");
       const out = [`**Notify ${channel}: ${to}**`];
-      if (str2(c.body)) out.push(blockquote(str2(c.body)));
-      if (str2(c.subject)) out.push(`- subject: ${str2(c.subject)}`);
+      if (str2(c.body)) out.push(blockquote(inputRef(str2(c.body))));
+      if (str2(c.subject)) out.push(`- subject: ${inputRef(str2(c.subject))}`);
       if (str2(c.attachmentRef)) out.push(`- attach: ${str2(c.attachmentRef)}`);
       return out;
     }
@@ -2182,7 +2331,7 @@ function renderNode(node) {
       const model = str2(nl?.model) ?? str2(c.model);
       const out = [`**Assert audio** ${str2(c.label) ?? "?"}`];
       out.push(`- severity: ${str2(c.severity) ?? "fail"}`);
-      if (prompt) out.push(`- prompt: ${prompt}`);
+      if (prompt) out.push(`- prompt: ${inputRef(prompt)}`);
       if (model) out.push(`- model: ${model}`);
       for (const [cfgKey, bulletKey] of [
         ["minDurationMs", "minDurationMs"],
@@ -2198,15 +2347,30 @@ function renderNode(node) {
       return out;
     }
     case "api_sequence": {
-      const title = str2(c.customActionTitle) ?? str2(c.title) ?? "API sequence";
+      const title = inputRef(str2(c.customActionTitle) ?? str2(c.title) ?? "API sequence");
       const out = [`**API sequence \u2014 ${title}**`];
-      if (str2(c.apiEndpointContext)) out.push(blockquote(str2(c.apiEndpointContext)));
+      if (str2(c.apiEndpointContext)) out.push(blockquote(inputRef(str2(c.apiEndpointContext))));
       if (str2(c.credentialInputName)) out.push(`- credential: ${str2(c.credentialInputName)}`);
       if (str2(c.__apiSequenceSidecar)) {
         out.push(`- apiSequence: ${str2(c.__apiSequenceSidecar)}`);
       }
       return out;
     }
+    case "sandbox_action": {
+      const slug = str2(c.actionSlug) ?? "?";
+      const out = [`**Sandbox action \u2014 ${slug}**`];
+      if (str2(c.description)) out.push(blockquote(inputRef(str2(c.description))));
+      if (str2(c.actionLabel)) out.push(`- label: ${str2(c.actionLabel)}`);
+      const params = obj2(c.params);
+      if (params) {
+        for (const [key, value] of Object.entries(params)) {
+          if (typeof value === "string") out.push(`- param.${key}: ${value}`);
+        }
+      }
+      const outputKeys = Array.isArray(c.outputKeys) ? c.outputKeys.filter((k) => typeof k === "string") : [];
+      if (outputKeys.length > 0) out.push(`- outputs: ${outputKeys.join(", ")}`);
+      return out;
+    }
     case "end":
       return [str2(c.outcome) === "fail" ? "**End (fail)**." : "**End**."];
     default:
@@ -2456,4 +2620,4 @@ export {
   writeWorkflowId,
   writeNodeIds
 };
-//# sourceMappingURL=chunk-B2VISN2V.js.map
+//# sourceMappingURL=chunk-YN763NWQ.js.map