@signalridge/pi-workflows 0.2.0 → 1.2.1

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## 1.2.1
+### Patch Changes
+
+- 24a8af4: Remove references to the maintainer's personal dotfile setup from shipped docs
+  and source comments. Each constraint is restated as a property of the package
+  itself: which manager owns a settings file, whether a project permits git
+  worktrees, and installing a package from a single source. No runtime behavior
+  changes.
+
+## 1.0.0
+### Major Changes
+
+- Adopt a unified 1.0.0 across every published package.
+  
+  The version numbers no longer track their upstream forks individually; from this release each package
+  is versioned on its own merit against the Signalridge line, and 1.0.0 is the shared starting point.
+  Packages whose behavior changed in this release document that change in their own changeset entries;
+  the remainder are re-released unchanged so the whole set shares one baseline.
+
+### Minor Changes
+
+- Chain dependency results into downstream prompts, sanitize child-agent output in the navigator, and make the detail-menu action mapping exhaustive.
+  
+  - `inputs`: a task may declare `inputs`, a duplicate-free subset of its own `depends_on`, so those dependencies' journaled results are appended to its dispatch prompt. `depends_on` on its own stays a pure scheduling barrier, so the DAG can now chain and not only fan out. The field is opt-in: a task without `inputs` dispatches a byte-identical prompt to before. Composition is a pure function of the journaled prefix — the declared `inputs` array is iterated in order and only journaled result fields are read — so a replay recomposes the same prompt and pi-subagents' managed spawn fingerprint stays stable across a branch rewind. Each result is capped at 6,000 characters and the appended section at 24,000, budgeted against the managed protocol's 100,000-character prompt ceiling, which rejects rather than truncates; when the authored prompt leaves too little headroom, nothing is appended.
+  - Forward-only journal compatibility: a `run_created` definition carrying `inputs` fails validation on an older `pi-workflows` build, which quarantines and reports that run rather than replaying it. Downgrading after authoring a workflow with `inputs` is not supported.
+  - Terminal safety: task results, task errors, and run errors are child-agent output and reached the `/workflows` navigator unsanitized, so a child could emit escape sequences that clear the screen, plant an OSC 8 hyperlink, or reorder the line with a bidi override. Every untrusted string is now neutralized before it is truncated — truncating first could cut through a sequence and leave a live introducer behind.
+  - `result_truncated=` in synthesis context now reflects the journaled `truncated` flag, which was previously always reported as `false` because results are already capped when they are journaled.
+  - Regression-proofing, not a behavior change: the `/workflows` detail menu built its action list from inline status literals. That mapping is now an exhaustively-typed `workflowActionsFor`, so adding a workflow status is a compile error instead of a silently wrong menu. Every status offers the same actions it did before.
+
+### Patch Changes
+
+- Updated dependencies
+- Updated dependencies
+- Updated dependencies
+- Updated dependencies
+- Updated dependencies
+- Updated dependencies
+  - @signalridge/pi-subagents@1.0.0
+  - @signalridge/pi-subagents-protocol@1.0.0
+
 ## Unreleased
 - **Semantic workflow tiers:** tasks, synthesis, and an optional run default can request only `small`, `medium`, or `large`; model and thinking policy stays inside pi-subagents. The release requires `@signalridge/pi-subagents >=0.16.0-signalridge.1` and the v3 `workflowTiers` capability.
 

package/README.md

@@ -4,7 +4,7 @@ Declarative DAG orchestration for Pi. The `workflow` tool validates phases, task
 
 ## Install
 
-`@signalridge/pi-workflows` requires `@signalridge/pi-subagents` `>=0.16.0-signalridge.1` with protocol v3 managed-spawn support. They are separate Pi packages: the peer dependency documents the requirement but intentionally does not auto-load or duplicate the subagent extension.
+`@signalridge/pi-workflows` requires `@signalridge/pi-subagents` `>=1.0.0` with protocol v3 managed-spawn support. They are separate Pi packages: the peer dependency documents the requirement but intentionally does not auto-load or duplicate the subagent extension.
 
 ```bash
 pi install npm:@signalridge/pi-subagents
@@ -20,16 +20,18 @@ pi -e ./packages/pi-subagents
 pi -e ./packages/pi-workflows
 ```
 
-Pi activates each package from its own `pi.extensions` manifest. The dotfiles migration configures these two local paths together; do not add a second source for either package.
+Pi activates each package from its own `pi.extensions` manifest. Install `pi-workflows` and `pi-subagents` from the same source — an npm copy of one alongside a local checkout of the other loads both, and the duplicate registers its tools twice.
 
 At `session_start`, this extension sends `subagents:rpc:ping` and verifies protocol version 3 plus the `managedSpawn`, `lifecycleOwner`, owner-scoped `ownedStop`, `ownedQuiescence`, and `workflowTiers` capabilities. The package floor and capability check prevent older v3 peers from receiving tiered requests they cannot validate. If the fork is missing, old, or duplicated incorrectly, workflow execution returns a diagnostic naming the required packages instead of dispatching agents. The legacy unowned stop RPC remains available to older external callers, but workflow cleanup never falls back to it.
 
 ## Tools and command
 
-- `workflow`: run a foreground or background workflow.
+- `workflow`: run a foreground or background workflow. `depends_on` is a scheduling barrier only. A task may additionally declare `inputs`, a duplicate-free subset of its own `depends_on`, to have those dependencies' journaled results appended to its dispatch prompt: each result is capped at 6,000 characters, the appended section at 24,000, and the whole prompt at the protocol's 100,000-character ceiling. When the task prompt leaves less than 512 characters of headroom, nothing is appended and the prompt dispatches unchanged. Omitting `inputs` dispatches exactly the authored prompt.
 - `workflow_control`: `list`, `get`, `pause`, `resume`, or `stop` a run. `get` returns bounded task and synthesis details including status, agent ID, compactions, and result/error previews.
 - `/workflows`: TUI run list/detail navigator. Live agent conversation navigation remains in pi-subagents FleetView.
 
+Composed input sections are a pure function of the journaled prefix — declared `inputs` order, journaled result fields only — so a replay reproduces the same prompt and the managed spawn fingerprint stays stable across a branch rewind.
+
 State is persisted as `pi.appendEntry("pi-workflows:journal", ...)` custom entries, which do not enter model context. Results and synthesis instructions are capped before journaling or dispatch. Interrupted runs reset unreconciled dispatches to a recoverable state and reuse their managed spawn keys; completed task facts are not dispatched again. A task failure stops remaining owned agents, journals their terminal callbacks, blocks dependents, and settles the workflow as failed.
 Restore rotation is journaled atomically per run (`run_recovery`) so a failed append leaves no partial generation; older multi-entry recovery prefixes remain replayable and are migrated with independent `attempt_recovery` entries.
 Each atomic recovery also carries a deterministic bounded `recoveryId` derived from its branch/run and attempt rotations. Replay treats an exact normalized duplicate as a no-op, quarantines same-ID conflicts, and accepts older schema-v2 atomic entries without an ID only through deterministic legacy normalization.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@signalridge/pi-workflows",
-  "version": "0.2.0",
+  "version": "1.2.1",
   "description": "Declarative DAG workflows backed by pi-subagents managed spawning.",
   "type": "module",
   "license": "MIT",
@@ -17,11 +17,11 @@
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "*",
     "@earendil-works/pi-tui": "*",
-    "@signalridge/pi-subagents": ">=0.16.0-signalridge.1"
+    "@signalridge/pi-subagents": ">=1.0.0"
   },
   "dependencies": {
     "@sinclair/typebox": "^0.34.49",
-    "@signalridge/pi-subagents-protocol": "^0.1.0"
+    "@signalridge/pi-subagents-protocol": "^1.0.0"
   },
   "pi": {
     "extensions": [

package/src/engine.ts

@@ -36,7 +36,18 @@ import {
   transitionWorkflow,
   type WorkflowStatus,
 } from "./state-machine.js";
-import { buildSynthesisPrompt, resultFromLifecycle } from "./synthesis.js";
+import {
+  buildBoundedResultSection,
+  buildSynthesisPrompt,
+  cap,
+  MAX_DISPATCH_PROMPT_CHARS,
+  MAX_TASK_INPUT_CHARS,
+  MAX_TASK_RESULT_CHARS,
+  MIN_TASK_INPUT_CHARS,
+  type ResultEntry,
+  resultFromLifecycle,
+  TASK_INPUT_HEADER,
+} from "./synthesis.js";
 
 const SYNTHESIS_NODE_ID = "__synthesis__";
 const MAX_WAITERS = 256;
@@ -1767,6 +1778,41 @@ export class WorkflowEngine {
     }
   }
 
+  /**
+   * Append the journaled results of `task.inputs` to its prompt.
+   *
+   * Must be a pure function of the journaled prefix: the composed prompt feeds pi-subagents'
+   * managed fingerprint, and a replay that recomposes a different prompt is reported as a spawn
+   * key conflict and fails the run non-retryably. So: iterate the declared `inputs` array in
+   * order (never `Object.keys(run.taskResults)`, whose order differs between a live run and a
+   * replay), read only journaled result fields (never `run.taskStatus`, live agent state, or the
+   * clock), and never throw — `dispatchTask` has no error path around composition.
+   */
+  private composeTaskPrompt(run: WorkflowRun, task: WorkflowTask): string {
+    const inputs = task.inputs ?? [];
+    if (inputs.length === 0) return task.prompt;
+    const separator = "\n\n";
+    // pi-subagents-protocol rejects an oversized prompt by throwing, so budget against the
+    // remaining headroom rather than adding a fixed section and hoping it fits.
+    const headroom = MAX_DISPATCH_PROMPT_CHARS - task.prompt.length - separator.length;
+    const budget = Math.min(MAX_TASK_INPUT_CHARS, headroom);
+    if (budget < MIN_TASK_INPUT_CHARS) return task.prompt;
+    const entries: ResultEntry[] = inputs.map((id) => {
+      const dependency = run.definition.tasks.find((candidate) => candidate.id === id);
+      return {
+        task: dependency ?? { id, description: id },
+        result: run.taskResults[id],
+        fallbackStatus: "missing",
+      };
+    });
+    const section = buildBoundedResultSection([TASK_INPUT_HEADER], entries, {
+      maxPerResult: MAX_TASK_RESULT_CHARS,
+      maxTotal: budget,
+      overflowMarker: "\n\n[dependency input truncated: additional results omitted]",
+    });
+    return cap(`${task.prompt}${separator}${section}`, MAX_DISPATCH_PROMPT_CHARS).text;
+  }
+
   private async dispatchTask(run: WorkflowRun, nodeId: string, branchEpoch: number): Promise<void> {
     const task = run.definition.tasks.find((candidate) => candidate.id === nodeId);
     if (
@@ -1778,8 +1824,14 @@ export class WorkflowEngine {
     )
       return;
     const attemptId = run.attemptIds[nodeId];
-    const dispatchTaskDefinition =
-      task.tier === undefined && run.definition.tier !== undefined ? { ...task, tier: run.definition.tier } : task;
+    const prompt = this.composeTaskPrompt(run, task);
+    const tierOverride = task.tier === undefined ? run.definition.tier : undefined;
+    // Keeping the `task` identity when nothing changes guarantees a byte-identical dispatch
+    // for every workflow that does not declare `inputs`.
+    const dispatchTaskDefinition: WorkflowTask =
+      tierOverride === undefined && prompt === task.prompt
+        ? task
+        : { ...task, prompt, ...(tierOverride === undefined ? {} : { tier: tierOverride }) };
     let response: ManagedSpawnResponse;
     try {
       response = normalizeManagedSpawnResponse(

package/src/index.ts

@@ -27,6 +27,7 @@ const TaskSchema = Type.Object(
     description: Type.String({ minLength: 1, maxLength: 512 }),
     prompt: Type.String({ minLength: 1, maxLength: 100_000 }),
     depends_on: Type.Optional(Type.Array(Type.String({ minLength: 1, maxLength: 128 }), { maxItems: 128 })),
+    inputs: Type.Optional(Type.Array(Type.String({ minLength: 1, maxLength: 128 }), { maxItems: 128 })),
   },
   { additionalProperties: false },
 );
@@ -117,6 +118,7 @@ export default function piWorkflows(pi: ExtensionAPI): void {
         promptSnippet: "Run independent tasks as a dependency-aware workflow",
         promptGuidelines: [
           "Use workflow for explicit multi-task DAG orchestration; an optional tier must be small, medium, or large. Do not include model, thinking, concurrency, retry, timeout, or turn-limit settings.",
+          "depends_on controls ordering only. To pass a dependency's result into a task, also list it in inputs, which must be a subset of that task's depends_on; those results are appended to the task prompt under a bounded budget.",
           "Use workflow_control to inspect, pause, resume, or stop a background workflow.",
         ],
         parameters: WorkflowSchema,

package/src/safe-text.ts

@@ -0,0 +1,44 @@
+/**
+ * Terminal-safety for untrusted text rendered by the `/workflows` navigator.
+ *
+ * Task results, task errors, and run errors originate in child agent sessions, so they are
+ * attacker-influenced from this package's point of view. Duplicated rather than imported:
+ * extensions must not depend on another extension's source (see docs/package-boundaries.md).
+ */
+
+/** Control, escape-introducing, and bidi-override code points a terminal would act on. */
+function isUnsafeTerminalCodePoint(codePoint: number): boolean {
+  return (
+    codePoint <= 0x1f ||
+    (codePoint >= 0x7f && codePoint <= 0x9f) ||
+    codePoint === 0x061c ||
+    codePoint === 0x200e ||
+    codePoint === 0x200f ||
+    (codePoint >= 0x202a && codePoint <= 0x202e) ||
+    (codePoint >= 0x2066 && codePoint <= 0x2069)
+  );
+}
+
+/**
+ * Replace every code point a terminal could interpret as control input with a space.
+ * Neutralizing the introducer (ESC, and the 8-bit C1 forms such as `0x9b` CSI) is what makes
+ * the remainder of a sequence inert payload text rather than a command.
+ */
+export function sanitizeTerminalText(value: string): string {
+  return [...value]
+    .map((character) => (isUnsafeTerminalCodePoint(character.codePointAt(0) ?? 0) ? " " : character))
+    .join("");
+}
+
+/**
+ * Single-line, bounded rendering of untrusted text.
+ *
+ * Sanitizing strictly before truncating is load-bearing: slicing first can cut through an
+ * escape sequence and leave a dangling introducer that swallows whatever the terminal draws
+ * next. Slicing by code point additionally avoids splitting a surrogate pair.
+ */
+export function sanitizeDisplayText(value: string, maximumLength: number): string {
+  if (maximumLength < 1) return "";
+  const safe = sanitizeTerminalText(value).replace(/\s+/gu, " ").trim();
+  return [...safe].slice(0, maximumLength).join("");
+}

package/src/schema.ts

@@ -19,6 +19,11 @@ export interface WorkflowTask {
   prompt: string;
   tier?: WorkflowTier;
   depends_on: string[];
+  /**
+   * Subset of `depends_on` whose journaled results are appended to this task's dispatch prompt.
+   * Opt-in: absent means `depends_on` stays a pure ordering barrier, as it always has been.
+   */
+  inputs?: string[];
 }
 
 export interface WorkflowSynthesis {
@@ -77,6 +82,25 @@ function stringArray(value: unknown, label: string, maxItems: number, maxText: n
   return value.map((item, index) => stringField(item, `${label}[${index}]`, maxText));
 }
 
+/**
+ * `inputs` must be a duplicate-free subset of the same task's `depends_on`, so it can never
+ * introduce an edge the cycle checker has not already seen.
+ */
+function validateTaskInputs(tasks: WorkflowTask[]): void {
+  for (const task of tasks) {
+    if (!task.inputs) continue;
+    const dependencies = new Set(task.depends_on);
+    const seen = new Set<string>();
+    for (const input of task.inputs) {
+      if (!dependencies.has(input)) {
+        throw new Error(`task "${task.id}" input "${input}" is not one of its depends_on`);
+      }
+      if (seen.has(input)) throw new Error(`task "${task.id}" lists duplicate input "${input}"`);
+      seen.add(input);
+    }
+  }
+}
+
 function validateDag(tasks: WorkflowTask[]): void {
   const ids = new Set(tasks.map((task) => task.id));
   const visiting = new Set<string>();
@@ -132,7 +156,7 @@ export function validateWorkflow(input: unknown): WorkflowDefinition {
     if (!isRecord(raw)) throw new Error(`tasks[${index}] must be an object`);
     assertObjectKeys(
       raw,
-      ["id", "phase", "tier", "subagent_type", "description", "prompt", "depends_on"],
+      ["id", "phase", "tier", "subagent_type", "description", "prompt", "depends_on", "inputs"],
       `tasks[${index}]`,
     );
     const task: WorkflowTask = {
@@ -143,6 +167,10 @@ export function validateWorkflow(input: unknown): WorkflowDefinition {
       description: stringField(raw.description, `tasks[${index}].description`, MAX_SHORT_TEXT),
       prompt: stringField(raw.prompt, `tasks[${index}].prompt`, MAX_TEXT),
       depends_on: stringArray(raw.depends_on, `tasks[${index}].depends_on`, MAX_TASKS, 128),
+      // Spread so an absent field stays absent and journaled definitions remain byte-stable.
+      ...(raw.inputs === undefined
+        ? {}
+        : { inputs: stringArray(raw.inputs, `tasks[${index}].inputs`, MAX_TASKS, 128) }),
     };
     if (taskIds.has(task.id)) throw new Error(`duplicate task id "${task.id}"`);
     taskIds.add(task.id);
@@ -151,6 +179,7 @@ export function validateWorkflow(input: unknown): WorkflowDefinition {
     }
     return task;
   });
+  validateTaskInputs(tasks);
   validateDag(tasks);
 
   let synthesis: WorkflowSynthesis | undefined;

package/src/state-machine.ts

@@ -34,6 +34,12 @@ const workflowTransitions: Record<WorkflowStatus, readonly WorkflowStatus[]> = {
   interrupted: ["running", "stopping", "stopped"],
 };
 
+/**
+ * Every `WorkflowStatus`, derived from the exhaustive transition table rather than re-listed,
+ * so a new union member cannot silently be omitted from status-driven enumerations.
+ */
+export const WORKFLOW_STATUSES: readonly WorkflowStatus[] = Object.keys(workflowTransitions) as WorkflowStatus[];
+
 const taskTransitions: Record<TaskStatus, readonly TaskStatus[]> = {
   pending: ["ready", "blocked", "stopped"],
   ready: ["dispatching", "blocked", "stopped"],

package/src/synthesis.ts

@@ -4,45 +4,69 @@ import type { WorkflowDefinition, WorkflowTask } from "./schema.js";
 export const MAX_TASK_RESULT_CHARS = 6_000;
 export const MAX_SYNTHESIS_INSTRUCTION_CHARS = 8_000;
 export const MAX_SYNTHESIS_INPUT_CHARS = 48_000;
+/** Aggregate budget for a task's `inputs` section; deliberately smaller than synthesis's. */
+export const MAX_TASK_INPUT_CHARS = 24_000;
+/** Must equal `boundedString`'s prompt cap in pi-subagents-protocol, which throws rather than truncating. */
+export const MAX_DISPATCH_PROMPT_CHARS = 100_000;
+/** Below this much headroom an input section carries no useful content, so none is injected. */
+export const MIN_TASK_INPUT_CHARS = 512;
+export const TASK_INPUT_HEADER = "Dependency results (pi-workflows inputs v1):";
 
-function cap(value: string, limit: number): { text: string; truncated: boolean } {
+export function cap(value: string, limit: number): { text: string; truncated: boolean } {
   if (value.length <= limit) return { text: value, truncated: false };
   const marker = "\n…[truncated]";
   const contentLimit = Math.max(0, limit - marker.length);
   return { text: `${value.slice(0, contentLimit)}${marker}`, truncated: true };
 }
 
-/** Build bounded, labeled synthesis context without concatenating full transcripts. */
-export function buildSynthesisPrompt(
-  definition: WorkflowDefinition,
-  run: WorkflowRun,
-  tasks: readonly WorkflowTask[] = definition.tasks,
-): string {
-  if (!definition.synthesis) throw new Error("workflow has no synthesis definition");
+export interface ResultEntry {
+  task: Pick<WorkflowTask, "id" | "description">;
+  result: WorkflowTaskResult | undefined;
+  /** Reported as `status=` only when no journaled result exists. */
+  fallbackStatus: string;
+}
 
-  const instruction = cap(definition.synthesis.prompt, MAX_SYNTHESIS_INSTRUCTION_CHARS);
-  const chunks: string[] = [instruction.text, "", "Workflow task results:"];
+export interface BoundedSectionOptions {
+  maxPerResult: number;
+  maxTotal: number;
+  overflowMarker: string;
+}
+
+/** One labeled, bounded result block. Reads only journaled fields so replays reproduce it exactly. */
+export function buildResultBlock(entry: ResultEntry, maxResultChars = MAX_TASK_RESULT_CHARS): string {
+  const { task, result } = entry;
+  const bounded = cap(result?.text ?? "(no result)", maxResultChars);
+  const pointers = [
+    result?.agentId ? `agent_id=${result.agentId}` : "agent_id=unknown",
+    result?.outputFile ? `transcript=${result.outputFile}` : undefined,
+    result?.tokenCount !== undefined ? `token_count=${result.tokenCount}` : undefined,
+  ]
+    .filter((value): value is string => value !== undefined)
+    .join(" ");
+  // `result.truncated` matters because `resultFromLifecycle` already caps text to
+  // MAX_TASK_RESULT_CHARS, so a re-cap here can never observe the original overflow.
+  const truncated = bounded.truncated || result?.truncated === true;
+  return [
+    `### ${task.id} — ${task.description}`,
+    `status=${result?.status ?? entry.fallbackStatus} ${pointers}`,
+    truncated ? "result_truncated=true" : "result_truncated=false",
+    bounded.text,
+  ].join("\n");
+}
+
+/** Append result blocks after `preamble` until the aggregate budget is reached. */
+export function buildBoundedResultSection(
+  preamble: readonly string[],
+  entries: readonly ResultEntry[],
+  options: BoundedSectionOptions,
+): string {
+  const chunks: string[] = [...preamble];
   let total = chunks.join("\n").length;
   let aggregateTruncated = false;
 
-  for (const task of tasks) {
-    const result = run.taskResults[task.id];
-    const text = result?.text ?? "(no result)";
-    const bounded = cap(text, MAX_TASK_RESULT_CHARS);
-    const pointers = [
-      result?.agentId ? `agent_id=${result.agentId}` : "agent_id=unknown",
-      result?.outputFile ? `transcript=${result.outputFile}` : undefined,
-      result?.tokenCount !== undefined ? `token_count=${result.tokenCount}` : undefined,
-    ]
-      .filter((value): value is string => value !== undefined)
-      .join(" ");
-    const block = [
-      `### ${task.id} — ${task.description}`,
-      `status=${result?.status ?? run.taskStatus[task.id]} ${pointers}`,
-      bounded.truncated ? "result_truncated=true" : "result_truncated=false",
-      bounded.text,
-    ].join("\n");
-    if (total + block.length + 2 > MAX_SYNTHESIS_INPUT_CHARS) {
+  for (const entry of entries) {
+    const block = buildResultBlock(entry, options.maxPerResult);
+    if (total + block.length + 2 > options.maxTotal) {
       aggregateTruncated = true;
       break;
     }
@@ -52,13 +76,34 @@ export function buildSynthesisPrompt(
 
   let output = chunks.join("\n");
   if (aggregateTruncated) {
-    const marker = "\n\n[aggregate synthesis input truncated: additional task results omitted]";
-    if (output.length + marker.length <= MAX_SYNTHESIS_INPUT_CHARS) {
-      output += marker;
+    if (output.length + options.overflowMarker.length <= options.maxTotal) {
+      output += options.overflowMarker;
     } else {
-      output = `${output.slice(0, MAX_SYNTHESIS_INPUT_CHARS - marker.length)}${marker}`;
+      output = `${output.slice(0, options.maxTotal - options.overflowMarker.length)}${options.overflowMarker}`;
     }
   }
+  return output;
+}
+
+/** Build bounded, labeled synthesis context without concatenating full transcripts. */
+export function buildSynthesisPrompt(
+  definition: WorkflowDefinition,
+  run: WorkflowRun,
+  tasks: readonly WorkflowTask[] = definition.tasks,
+): string {
+  if (!definition.synthesis) throw new Error("workflow has no synthesis definition");
+
+  const instruction = cap(definition.synthesis.prompt, MAX_SYNTHESIS_INSTRUCTION_CHARS);
+  const entries = tasks.map((task) => ({
+    task,
+    result: run.taskResults[task.id],
+    fallbackStatus: String(run.taskStatus[task.id]),
+  }));
+  const output = buildBoundedResultSection([instruction.text, "", "Workflow task results:"], entries, {
+    maxPerResult: MAX_TASK_RESULT_CHARS,
+    maxTotal: MAX_SYNTHESIS_INPUT_CHARS,
+    overflowMarker: "\n\n[aggregate synthesis input truncated: additional task results omitted]",
+  });
   return cap(output, MAX_SYNTHESIS_INPUT_CHARS).text;
 }
 

package/src/ui.ts

@@ -2,6 +2,15 @@ import type { ExtensionCommandContext, Theme } from "@earendil-works/pi-coding-a
 import { DynamicBorder } from "@earendil-works/pi-coding-agent";
 import { Container, type SelectItem, SelectList, Text } from "@earendil-works/pi-tui";
 import type { WorkflowEngine, WorkflowSummary } from "./engine.js";
+import { sanitizeDisplayText } from "./safe-text.js";
+import { isTerminalWorkflow, type WorkflowStatus } from "./state-machine.js";
+
+/** Bounds, in code points, for untrusted strings rendered into the navigator. */
+const MAX_NAME_CHARS = 200;
+const MAX_ID_CHARS = 128;
+const MAX_RESULT_CHARS = 300;
+const MAX_RUN_ERROR_CHARS = 500;
+const MAX_DESCRIPTION_CHARS = 120;
 
 function elapsed(ms: number): string {
   const seconds = Math.floor(ms / 1_000);
@@ -13,7 +22,8 @@ function elapsed(ms: number): string {
 export function formatWorkflowRunLabel(run: WorkflowSummary): string {
   const phases = run.phaseCount > 0 ? ` · phases ${run.completedPhases}/${run.phaseCount}` : "";
   const tokens = run.tokenCount === undefined ? "" : ` · ${run.tokenCount} tokens`;
-  return `${run.name} · ${run.status}${phases} · ${run.completedTasks}/${run.taskCount} tasks · ${elapsed(run.elapsedMs)}${tokens}`;
+  const name = sanitizeDisplayText(run.name, MAX_NAME_CHARS);
+  return `${name} · ${run.status}${phases} · ${run.completedTasks}/${run.taskCount} tasks · ${elapsed(run.elapsedMs)}${tokens}`;
 }
 
 export function formatWorkflowDetail(engine: WorkflowEngine, runId: string): string {
@@ -24,22 +34,22 @@ export function formatWorkflowDetail(engine: WorkflowEngine, runId: string): str
     .filter((value): value is number => value !== undefined);
   const tokenCount = tokenValues.length > 0 ? tokenValues.reduce((total, value) => total + value, 0) : undefined;
   const lines = [
-    `${run.definition.name} [${run.status}]`,
-    `run: ${run.runId}`,
-    `elapsed: ${elapsed(Math.max(0, (run.status === "completed" || run.status === "failed" || run.status === "stopped" ? run.updatedAt : Date.now()) - run.startedAt))}`,
+    `${sanitizeDisplayText(run.definition.name, MAX_NAME_CHARS)} [${run.status}]`,
+    `run: ${sanitizeDisplayText(run.runId, MAX_ID_CHARS)}`,
+    `elapsed: ${elapsed(Math.max(0, (isTerminalWorkflow(run.status) ? run.updatedAt : Date.now()) - run.startedAt))}`,
     "",
     ...(tokenCount === undefined ? [] : [`tokens: ${tokenCount}`]),
   ];
   for (const phase of run.definition.phases) {
-    lines.push(`Phase: ${phase.title}`);
+    lines.push(`Phase: ${sanitizeDisplayText(phase.title, MAX_NAME_CHARS)}`);
     for (const task of run.definition.tasks.filter((candidate) => candidate.phase === phase.id)) {
       const status = run.taskStatus[task.id] ?? "pending";
-      const agent = run.agentIds[task.id] ? ` agent=${run.agentIds[task.id]}` : "";
+      const agent = run.agentIds[task.id] ? ` agent=${sanitizeDisplayText(run.agentIds[task.id], MAX_ID_CHARS)}` : "";
       const compact = run.compactions[task.id] ? ` compactions=${run.compactions[task.id]}` : "";
-      lines.push(`  ${status.padEnd(11)} ${task.id}${agent}${compact}`);
+      lines.push(`  ${status.padEnd(11)} ${sanitizeDisplayText(task.id, MAX_ID_CHARS)}${agent}${compact}`);
       const result = run.taskResults[task.id];
-      if (result?.error) lines.push(`    error: ${result.error.slice(0, 300)}`);
-      if (result?.text) lines.push(`    result: ${result.text.replaceAll("\n", " ").slice(0, 300)}`);
+      if (result?.error) lines.push(`    error: ${sanitizeDisplayText(result.error, MAX_RESULT_CHARS)}`);
+      if (result?.text) lines.push(`    result: ${sanitizeDisplayText(result.text, MAX_RESULT_CHARS)}`);
     }
   }
   const unphased = run.definition.tasks.filter((task) => task.phase === undefined);
@@ -47,15 +57,55 @@ export function formatWorkflowDetail(engine: WorkflowEngine, runId: string): str
     lines.push("Tasks:");
     for (const task of unphased) {
       const status = run.taskStatus[task.id] ?? "pending";
-      const agent = run.agentIds[task.id] ? ` agent=${run.agentIds[task.id]}` : "";
-      lines.push(`  ${status.padEnd(11)} ${task.id}${agent}`);
+      const agent = run.agentIds[task.id] ? ` agent=${sanitizeDisplayText(run.agentIds[task.id], MAX_ID_CHARS)}` : "";
+      lines.push(`  ${status.padEnd(11)} ${sanitizeDisplayText(task.id, MAX_ID_CHARS)}${agent}`);
     }
   }
   lines.push("", "Live agent conversations remain available through pi-subagents FleetView.");
-  if (run.error) lines.push(`Error: ${run.error.slice(0, 500)}`);
+  if (run.error) lines.push(`Error: ${sanitizeDisplayText(run.error, MAX_RUN_ERROR_CHARS)}`);
   return lines.join("\n");
 }
 
+/** Actions the `/workflows` detail menu can offer, in display order. */
+export type WorkflowAction = "refresh" | "pause" | "resume" | "stop" | "back";
+
+export interface WorkflowActionItem {
+  value: WorkflowAction;
+  label: string;
+}
+
+const REFRESH: WorkflowActionItem = { value: "refresh", label: "Refresh" };
+const PAUSE: WorkflowActionItem = { value: "pause", label: "Pause" };
+const RESUME: WorkflowActionItem = { value: "resume", label: "Resume" };
+const STOP: WorkflowActionItem = { value: "stop", label: "Stop" };
+const BACK: WorkflowActionItem = { value: "back", label: "Back" };
+
+/**
+ * Menu actions legal for a run in `status`, mirroring what `WorkflowEngine.control` accepts.
+ * Exhaustive by construction: there is no `default` arm, so adding a `WorkflowStatus` member
+ * is a compile error here instead of a silently wrong menu.
+ */
+export function workflowActionsFor(status: WorkflowStatus): readonly WorkflowActionItem[] {
+  switch (status) {
+    case "pending":
+    case "pausing":
+    case "synthesizing":
+    case "stopping":
+      return [REFRESH, STOP, BACK];
+    case "running":
+      return [REFRESH, PAUSE, STOP, BACK];
+    case "paused":
+    case "interrupted":
+      return [REFRESH, RESUME, STOP, BACK];
+    case "completed":
+    case "failed":
+    case "stopped":
+      return [REFRESH, BACK];
+  }
+  const unreachable: never = status;
+  return unreachable;
+}
+
 async function selectList<T>(
   ctx: ExtensionCommandContext,
   title: string,
@@ -102,7 +152,7 @@ export async function showWorkflowNavigator(ctx: ExtensionCommandContext, engine
       runs.map((run) => ({
         value: run.runId,
         label: formatWorkflowRunLabel(run),
-        description: run.error?.slice(0, 120),
+        description: run.error === undefined ? undefined : sanitizeDisplayText(run.error, MAX_DESCRIPTION_CHARS),
       })),
       (theme) =>
         runs.length > 0
@@ -113,26 +163,24 @@ export async function showWorkflowNavigator(ctx: ExtensionCommandContext, engine
     while (true) {
       const run = engine.get(selected);
       if (!run) break;
-      const action = await selectList<string>(
+      const name = sanitizeDisplayText(run.name, MAX_NAME_CHARS);
+      const action = await selectList<WorkflowAction>(
         ctx,
-        `${run.name} · ${run.status}`,
-        [
-          { value: "refresh", label: "Refresh" },
-          ...(run.status === "running" ? [{ value: "pause", label: "Pause" }] : []),
-          ...(run.status === "paused" || run.status === "interrupted" ? [{ value: "resume", label: "Resume" }] : []),
-          ...(!["completed", "failed", "stopped"].includes(run.status) ? [{ value: "stop", label: "Stop" }] : []),
-          { value: "back", label: "Back" },
-        ],
+        `${name} · ${run.status}`,
+        workflowActionsFor(run.status).map((item) => ({
+          value: item.value,
+          label: item.label,
+        })),
         () => formatWorkflowDetail(engine, selected),
       );
-      if (!action || action === "back") break;
+      if (action === undefined || action === "back") break;
       if (action === "refresh") continue;
       if (action === "stop") {
-        const confirmed = await ctx.ui.confirm("Stop workflow", `Stop ${run.name}? The run will be non-resumable.`);
+        const confirmed = await ctx.ui.confirm("Stop workflow", `Stop ${name}? The run will be non-resumable.`);
         if (!confirmed) continue;
       }
       try {
-        await engine.control(action as "pause" | "resume" | "stop", selected);
+        await engine.control(action, selected);
         ctx.ui.notify(`Workflow ${action} requested.`, "info");
       } catch (error: unknown) {
         ctx.ui.notify(error instanceof Error ? error.message : String(error), "error");