@stigmer/cli 3.0.8

package/src/resources/run/resolve.ts

@@ -0,0 +1,32 @@
+// Reference resolution for the run path (Go's resolveAgent / resolveWorkflow in
+// run_resolve.go). A reference is an ID (agt_…/wfl_…), an explicit org/slug, or
+// a bare slug resolved against the context org. The strict ID *classification*
+// used by smart dispatch lives in resources/reference.ts; this module just turns
+// a reference into a fetched resource.
+
+import type { Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import type { Workflow } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { Stigmer } from "@stigmer/sdk";
+import { defaultRegistry } from "../../registry/index.js";
+import { parseReference } from "../reference.js";
+
+/** Resolve an agent by ID, org/slug, or bare slug. Throws if not found. */
+export async function resolveAgentRef(client: Stigmer, ref: string, org: string): Promise<Agent> {
+  const parsed = parseReference(ref, org, idPrefix(ApiResourceKind.agent));
+  if (parsed.kind === "id") return client.agent.get(parsed.id);
+  return client.agent.getByReference({ org: parsed.org, slug: parsed.slug });
+}
+
+/** Resolve a workflow by ID, org/slug, or bare slug. Throws if not found. */
+export async function resolveWorkflowRef(client: Stigmer, ref: string, org: string): Promise<Workflow> {
+  const parsed = parseReference(ref, org, idPrefix(ApiResourceKind.workflow));
+  if (parsed.kind === "id") return client.workflow.get(parsed.id);
+  return client.workflow.getByReference({ org: parsed.org, slug: parsed.slug });
+}
+
+// The id_prefix for a kind, via the shared registry (single source of truth).
+function idPrefix(kind: ApiResourceKind): string {
+  const alias = kind === ApiResourceKind.agent ? "agent" : "workflow";
+  return defaultRegistry().getByAlias(alias)?.idPrefix ?? "";
+}

package/src/resources/run/resume.ts

@@ -0,0 +1,119 @@
+// Re-opening an existing session (Go's openSession / resumeSession in
+// resume_session.go). Fetch the session + its executions, then either:
+//   - re-attach to the live stream when the latest execution is still active, or
+//   - replay the full history (snapshotToEvents) when everything has finished.
+// The TTY path defers to Ink's SessionView, which loads history and offers a
+// follow-up composer for free.
+
+import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { ApprovalAction, ExecutionPhase, InteractionMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import type { BackendClient } from "../../client/index.js";
+import { getSessionById, listExecutionsBySession } from "../session.js";
+import { NdjsonRenderer } from "../stream/render-ndjson.js";
+import { PlaintextRenderer } from "../stream/render-plaintext.js";
+import { snapshotToEvents } from "../stream/snapshot.js";
+import { isInkSupported } from "../stream/tty.js";
+import { renderSessionHeader, type SessionHeaderInfo, workspaceNames } from "./header.js";
+import type { RunMode } from "./prepare.js";
+import { streamAgentExecution, type RunOutputMode } from "./stream.js";
+
+// The backend's auto-create sentinel; suppressed in the header until the async
+// title activity replaces it (Go's session.PendingSubject / ResolvedSubject).
+const PENDING_SUBJECT = "Auto-created session";
+
+// Phases where the latest execution is still producing output — re-attach live.
+const ACTIVE_PHASES: ReadonlySet<ExecutionPhase> = new Set([
+  ExecutionPhase.EXECUTION_PENDING,
+  ExecutionPhase.EXECUTION_IN_PROGRESS,
+  ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL,
+  ExecutionPhase.EXECUTION_PAUSED,
+]);
+
+export interface OpenSessionDeps {
+  readonly client: BackendClient;
+  readonly sessionId: string;
+  readonly org: string;
+  /** Explicit --mode override; "" means infer from the latest execution. */
+  readonly mode: RunMode;
+  readonly outputMode: RunOutputMode;
+}
+
+export async function openSession(deps: OpenSessionDeps): Promise<void> {
+  const stigmer = deps.client.stigmer;
+  const session = await getSessionById(stigmer, deps.sessionId);
+  const entries = await listExecutionsBySession(stigmer, deps.sessionId);
+  if (entries.length === 0) {
+    process.stderr.write(`Session ${deps.sessionId} has no executions\n`);
+    return;
+  }
+
+  const latest = entries[0];
+  const phase = latest.status?.phase ?? ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED;
+  const effectiveMode = resolveResumeMode(deps.mode, latest);
+
+  const header: SessionHeaderInfo = {
+    agentName: "",
+    sessionId: deps.sessionId,
+    subject: resolvedSubject(session.spec?.subject ?? ""),
+    model: "",
+    mode: effectiveMode,
+    workspaces: workspaceNames(session.spec?.workspaceEntries ?? []),
+  };
+
+  if (ACTIVE_PHASES.has(phase)) {
+    // Live re-attach reuses the exact run streaming stack.
+    await streamAgentExecution({
+      client: stigmer,
+      sessionId: deps.sessionId,
+      executionId: latest.metadata?.id ?? "",
+      org: deps.org,
+      mode: effectiveMode,
+      defaultAction: ApprovalAction.UNSPECIFIED,
+      outputMode: deps.outputMode,
+      header,
+    });
+    return;
+  }
+
+  await replaySession(deps, entries, header);
+}
+
+// Completed session: render the stored history. TTY → Ink (history + composer);
+// headless → snapshot events through the matching renderer.
+async function replaySession(
+  deps: OpenSessionDeps,
+  entries: readonly AgentExecution[],
+  header: SessionHeaderInfo,
+): Promise<void> {
+  if (deps.outputMode === "inline" && isInkSupported(process.stdout)) {
+    const { runInkSession } = await import("../stream/ink.js");
+    await runInkSession({
+      client: deps.client.stigmer,
+      sessionId: deps.sessionId,
+      org: deps.org,
+      mode: header.mode === "plan" ? "plan" : "agent",
+    });
+    return;
+  }
+
+  renderSessionHeader(process.stderr, header);
+  const chronological = [...entries].reverse();
+  const events = snapshotToEvents(chronological);
+  const renderer =
+    deps.outputMode === "json"
+      ? new NdjsonRenderer({ data: process.stdout, status: process.stderr, defaultAction: ApprovalAction.UNSPECIFIED })
+      : new PlaintextRenderer({ data: process.stdout, status: process.stderr });
+  for (const event of events) renderer.render(event);
+}
+
+// Mirrors Go's resolveResumeMode: --mode wins; else infer "plan" from the last
+// execution's InteractionMode; else default (agent).
+function resolveResumeMode(explicit: RunMode, latest: AgentExecution): RunMode {
+  if (explicit !== "") return explicit;
+  if (latest.spec?.executionConfig?.interactionMode === InteractionMode.PLAN) return "plan";
+  return "";
+}
+
+function resolvedSubject(subject: string): string {
+  return subject === PENDING_SUBJECT ? "" : subject;
+}

package/src/resources/run/stream.ts

@@ -0,0 +1,108 @@
+// Renderer dispatch for a created execution (Go's streamAgentExecution in
+// run_stream.go). One of three paths is selected from the output mode and TTY:
+//
+//   --json            → headless NDJSON differ (stdout), Go's run --json taxonomy
+//   inline + TTY      → in-process Ink (SessionView), lazily imported
+//   inline + non-TTY  → headless plaintext differ (piped stdout)
+//
+// All three converge on the same epilogue (final Get + usage summary). The
+// headless paths share one driver (runHeadlessStream) over the SDK's
+// agentExecution.subscribe / submitApproval; the differ + renderers are the
+// CLI-local port of Go's streamToEvents + handleJSONEvent.
+
+import { create } from "@bufbuild/protobuf";
+import type { AgentExecution } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { ApprovalAction } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { SubmitApprovalInputSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/io_pb";
+import type { Stigmer } from "@stigmer/sdk";
+import { runEpilogue } from "./epilogue.js";
+import { renderSessionHeader, type SessionHeaderInfo } from "./header.js";
+import type { RunMode } from "./prepare.js";
+import { runHeadlessStream, type HeadlessRenderer, type HeadlessResult } from "../stream/headless.js";
+import { NdjsonRenderer } from "../stream/render-ndjson.js";
+import { PlaintextRenderer } from "../stream/render-plaintext.js";
+import { isInkSupported } from "../stream/tty.js";
+
+/** The user-selected output mode for a streaming command. */
+export type RunOutputMode = "inline" | "json";
+
+export interface StreamDeps {
+  readonly client: Stigmer;
+  readonly sessionId: string;
+  readonly executionId: string;
+  /** Org slug, for follow-up executions created from the Ink composer. */
+  readonly org: string;
+  readonly mode: RunMode;
+  readonly defaultAction: ApprovalAction;
+  readonly outputMode: RunOutputMode;
+  readonly header: SessionHeaderInfo;
+}
+
+/**
+ * Stream the execution to a terminal phase, then run the epilogue. Returns the
+ * authoritative final execution (for artifact download).
+ */
+export async function streamAgentExecution(deps: StreamDeps): Promise<AgentExecution> {
+  if (deps.outputMode === "json") {
+    renderSessionHeader(process.stderr, deps.header);
+    const result = await runHeadless(deps, jsonRenderer(deps));
+    return runEpilogue(deps.client, deps.sessionId, deps.executionId, result);
+  }
+
+  if (isInkSupported(process.stdout)) {
+    await runInk(deps);
+    // Ink owns the live view; the epilogue still prints the exit summary.
+    return runEpilogue(deps.client, deps.sessionId, deps.executionId, { phase: "", error: "" });
+  }
+
+  renderSessionHeader(process.stderr, deps.header);
+  const result = await runHeadless(deps, plaintextRenderer());
+  return runEpilogue(deps.client, deps.sessionId, deps.executionId, result);
+}
+
+function jsonRenderer(deps: StreamDeps): HeadlessRenderer {
+  return new NdjsonRenderer({ data: process.stdout, status: process.stderr, defaultAction: deps.defaultAction });
+}
+
+function plaintextRenderer(): HeadlessRenderer {
+  return new PlaintextRenderer({ data: process.stdout, status: process.stderr });
+}
+
+// Drive a headless renderer over the SDK stream, with Ctrl-C wired to abort the
+// subscription cleanly (Go cancels the stream context on signal; the driver
+// treats an aborted signal as a clean exit and the epilogue prints the phase).
+async function runHeadless(deps: StreamDeps, renderer: HeadlessRenderer): Promise<HeadlessResult> {
+  const controller = new AbortController();
+  const onSignal = (): void => controller.abort();
+  process.once("SIGINT", onSignal);
+  process.once("SIGTERM", onSignal);
+
+  try {
+    return await runHeadlessStream({
+      subscribe: (signal) => deps.client.agentExecution.subscribe(deps.executionId, signal),
+      submitApproval: async (toolCallId, action) => {
+        await deps.client.agentExecution.submitApproval(
+          create(SubmitApprovalInputSchema, { agentExecutionId: deps.executionId, toolCallId, action }),
+        );
+      },
+      renderer,
+      sessionId: deps.sessionId,
+      signal: controller.signal,
+    });
+  } finally {
+    process.removeListener("SIGINT", onSignal);
+    process.removeListener("SIGTERM", onSignal);
+  }
+}
+
+// Lazily import the Ink renderer so React/Ink load only on the interactive path
+// (DD-001 boundary — non-streaming commands and --help never pay for them).
+async function runInk(deps: StreamDeps): Promise<void> {
+  const { runInkSession } = await import("../stream/ink.js");
+  await runInkSession({
+    client: deps.client,
+    sessionId: deps.sessionId,
+    org: deps.org,
+    mode: deps.mode === "plan" ? "plan" : "agent",
+  });
+}

package/src/resources/run/workflow-stream.integration.test.ts

@@ -0,0 +1,157 @@
+// In-process integration test for live `run workflow` streaming.
+//
+// Stands up a real Connect backend serving workflowExecution.subscribeEvents
+// (the canonical event stream) plus get + submitApproval, points an SDK node
+// client at it, and drives streamWorkflowExecution end to end: NDJSON vs inline
+// rendering (D-WF-1), policy-driven approval submission on approval_requested,
+// terminal-event stop, and the final-Get epilogue summary.
+
+import { create } from "@bufbuild/protobuf";
+import type { ConnectRouter } from "@connectrpc/connect";
+import { connectNodeAdapter } from "@connectrpc/connect-node";
+import { ApprovalAction } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { WorkflowExecutionSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
+import { WorkflowExecutionCommandController } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/command_pb";
+import { ExecutionPhase, WorkflowTaskStatus } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/enum_pb";
+import {
+  type WorkflowExecutionEvent,
+  WorkflowExecutionEventSchema,
+  WorkflowEventType,
+} from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/event_pb";
+import type { SubmitWorkflowApprovalInput } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/io_pb";
+import { WorkflowExecutionQueryController } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/query_pb";
+import type { Stigmer } from "@stigmer/sdk";
+import { createNodeClient, normalizeEndpoint } from "@stigmer/sdk/node";
+import { createServer as createHttp2Server, type Http2Server, type ServerHttp2Session } from "node:http2";
+import type { AddressInfo } from "node:net";
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
+import { streamWorkflowExecution, type WorkflowStreamStreams } from "./workflow-stream.js";
+
+let backend: Http2Server;
+let client: Stigmer;
+const openSessions = new Set<ServerHttp2Session>();
+let approvals: SubmitWorkflowApprovalInput[] = [];
+
+beforeEach(() => {
+  approvals = [];
+});
+
+// Final state returned by the epilogue Get: one task done, one failed.
+const finalExec = create(WorkflowExecutionSchema, {
+  metadata: { id: "wex_1", name: "Deploy" },
+  status: {
+    phase: ExecutionPhase.EXECUTION_COMPLETED,
+    startedAt: "2026-06-12T10:00:00Z",
+    completedAt: "2026-06-12T10:01:30Z",
+    tasks: [
+      { taskName: "build", status: WorkflowTaskStatus.WORKFLOW_TASK_COMPLETED },
+      { taskName: "ship", status: WorkflowTaskStatus.WORKFLOW_TASK_FAILED },
+    ],
+  },
+});
+
+function event(type: WorkflowEventType, payload: WorkflowExecutionEvent["payload"], taskName = "") {
+  return create(WorkflowExecutionEventSchema, { eventType: type, occurredAt: "2026-06-12T10:00:01Z", taskName, payload });
+}
+
+beforeAll(async () => {
+  const routes = (router: ConnectRouter) => {
+    router.service(WorkflowExecutionQueryController, {
+      get: () => finalExec,
+      subscribeEvents: async function* () {
+        yield event(WorkflowEventType.execution_started, { case: "executionStarted", value: {} as never });
+        yield event(WorkflowEventType.task_started, { case: "taskStarted", value: {} as never }, "build");
+        yield event(
+          WorkflowEventType.approval_requested,
+          { case: "approvalRequested", value: { toolCallId: "tc_99", prompt: "delete prod?" } as never },
+          "ship",
+        );
+        yield event(WorkflowEventType.execution_completed, { case: "executionCompleted", value: {} as never });
+      },
+    });
+    router.service(WorkflowExecutionCommandController, {
+      submitApproval: (req) => (approvals.push(req), finalExec),
+    });
+  };
+
+  backend = createHttp2Server(connectNodeAdapter({ routes }));
+  backend.on("session", (session) => {
+    openSessions.add(session);
+    session.on("close", () => openSessions.delete(session));
+  });
+  await new Promise<void>((resolve) => backend.listen(0, "127.0.0.1", resolve));
+  const port = (backend.address() as AddressInfo).port;
+  client = createNodeClient({ baseUrl: normalizeEndpoint(`127.0.0.1:${port}`) });
+});
+
+afterAll(async () => {
+  for (const session of openSessions) session.destroy();
+  await new Promise<void>((resolve) => backend.close(() => resolve()));
+});
+
+function capture(): { streams: WorkflowStreamStreams; data: () => string; status: () => string } {
+  const out: string[] = [];
+  const err: string[] = [];
+  return {
+    streams: { data: (l) => out.push(l), status: (l) => err.push(l), colorize: false },
+    data: () => out.join(""),
+    status: () => err.join("\n"),
+  };
+}
+
+describe("live run workflow streaming", () => {
+  it("renders inline plaintext, auto-resolves approval, and prints the epilogue", async () => {
+    const cap = capture();
+    const result = await streamWorkflowExecution(
+      { client, executionId: "wex_1", outputMode: "inline", defaultAction: ApprovalAction.APPROVE },
+      cap.streams,
+    );
+
+    const data = cap.data();
+    expect(data).toContain("execution started");
+    expect(data).toContain("task started: build");
+    expect(data).toContain("approval requested: ship — delete prod?");
+    expect(data).toContain("execution completed");
+
+    // Policy resolved the approval: one submit with the right tool call + action.
+    expect(approvals).toHaveLength(1);
+    expect(approvals[0].toolCallId).toBe("tc_99");
+    expect(approvals[0].action).toBe(ApprovalAction.APPROVE);
+    expect(cap.status()).toContain("Approval auto-resolved (approve) for tc_99");
+
+    // Epilogue summary from the final Get.
+    expect(cap.status()).toContain("Workflow completed");
+    expect(cap.status()).toContain("1 completed");
+    expect(cap.status()).toContain("1 failed");
+    expect(result.metadata?.id).toBe("wex_1");
+  });
+
+  it("emits NDJSON event envelopes with canonical type names (D-WF-1)", async () => {
+    const cap = capture();
+    await streamWorkflowExecution(
+      { client, executionId: "wex_1", outputMode: "json", defaultAction: ApprovalAction.APPROVE },
+      cap.streams,
+    );
+
+    const lines = cap.data().trim().split("\n").map((l) => JSON.parse(l));
+    expect(lines.map((e) => e.type)).toEqual([
+      "execution_started",
+      "task_started",
+      "approval_requested",
+      "execution_completed",
+    ]);
+    const approval = lines.find((e) => e.type === "approval_requested");
+    expect(approval.payload.task).toBe("ship");
+  });
+
+  it("leaves the approval for the user when no policy is configured", async () => {
+    const cap = capture();
+    await streamWorkflowExecution(
+      { client, executionId: "wex_1", outputMode: "inline", defaultAction: ApprovalAction.UNSPECIFIED },
+      cap.streams,
+    );
+
+    expect(approvals).toHaveLength(0);
+    expect(cap.status()).toContain("stigmer execution approve wex_1 --tool-call tc_99 --action approve");
+  });
+});

package/src/resources/run/workflow-stream.ts

@@ -0,0 +1,203 @@
+// Live `run workflow` streaming over the canonical WorkflowExecutionEvent stream.
+//
+// Unlike the agent path (which has only status snapshots and so must diff them —
+// see resources/stream/headless.ts), WorkflowExecution exposes subscribeEvents:
+// an incremental, sequenced, persisted event stream with explicit terminal
+// markers. A live run view *is* a timeline view, so we consume that stream
+// directly and render through the shared workflow event renderer (B1). This is
+// why `run workflow`, `execution logs`, and the web execution viewer all speak
+// the same event vocabulary — the server's — instead of a CLI-private one.
+//
+// Mirrors the *behavior* of Go's streamWorkflowExecution (run_stream.go): render
+// progress, resolve bubbled tool approvals via the run's approval policy, stop on
+// a terminal state, then print a completion summary. It diverges deliberately on
+// the source primitive (events, not snapshots) and on approvals: per the shipped
+// decision, workflows have no inline raw-mode prompter, so an approval is either
+// resolved by the configured policy (--approve-default / --auto-approve) or left
+// for the user to resolve out-of-band via `stigmer execution approve`.
+
+import { create } from "@bufbuild/protobuf";
+import { ApprovalAction } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import type { WorkflowExecution, WorkflowTask } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/api_pb";
+import { ExecutionPhase, WorkflowTaskStatus } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/enum_pb";
+import type { WorkflowExecutionEvent } from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/event_pb";
+import {
+  SubmitWorkflowApprovalInputSchema,
+  SubscribeEventsRequestSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/workflowexecution/v1/io_pb";
+import type { Stigmer } from "@stigmer/sdk";
+import { shouldColorize, type Styler, styler } from "../../output/style.js";
+import { calculateDuration } from "../execution-format.js";
+import { formatWorkflowPhase } from "../execution.js";
+import { APPROVAL_RETRY_BASE_DELAY_MS, APPROVAL_RETRY_MAX_ATTEMPTS, retryWithBackoff } from "../stream/submit.js";
+import { toWorkflowEventView } from "../stream/workflow-event-view.js";
+import { renderWorkflowEventPlaintext } from "../stream/workflow-render-plaintext.js";
+import { workflowEventToNdjson } from "../stream/workflow-render-ndjson.js";
+
+/** Output mode for the run stream: human (inline) lines or NDJSON. */
+export type RunOutputMode = "inline" | "json";
+
+export interface WorkflowStreamDeps {
+  readonly client: Stigmer;
+  readonly executionId: string;
+  readonly outputMode: RunOutputMode;
+  /** Approval policy: APPROVE_ALL when --auto-approve, else --approve-default (or UNSPECIFIED). */
+  readonly defaultAction: ApprovalAction;
+}
+
+/** Output sinks; defaults to stdout (events) + stderr (notices/summary). */
+export interface WorkflowStreamStreams {
+  data(line: string): void;
+  status(line: string): void;
+  readonly colorize: boolean;
+}
+
+/**
+ * Stream a workflow execution to a terminal state, then print a summary. Returns
+ * the authoritative final execution (a final Get), mirroring the agent path's
+ * return for symmetry. Ctrl-C aborts the subscription cleanly.
+ */
+export async function streamWorkflowExecution(
+  deps: WorkflowStreamDeps,
+  streams: WorkflowStreamStreams = defaultStreams(),
+): Promise<WorkflowExecution> {
+  const controller = new AbortController();
+  const onSignal = (): void => controller.abort();
+  process.once("SIGINT", onSignal);
+  process.once("SIGTERM", onSignal);
+
+  const resolved = new Set<string>();
+  try {
+    const stream = deps.client.workflowExecution.subscribeEvents(
+      create(SubscribeEventsRequestSchema, { executionId: deps.executionId }),
+      controller.signal,
+    );
+    for await (const event of stream) {
+      renderEvent(event, deps.outputMode, streams);
+      await maybeResolveApproval(event, deps, streams, resolved, controller.signal);
+      if (toWorkflowEventView(event).terminal) break;
+    }
+  } catch (error) {
+    if (!controller.signal.aborted) throw error;
+  } finally {
+    process.removeListener("SIGINT", onSignal);
+    process.removeListener("SIGTERM", onSignal);
+  }
+
+  return runWorkflowEpilogue(deps.client, deps.executionId, streams);
+}
+
+function renderEvent(event: WorkflowExecutionEvent, mode: RunOutputMode, streams: WorkflowStreamStreams): void {
+  if (mode === "json") {
+    streams.data(`${JSON.stringify(workflowEventToNdjson(event))}\n`);
+    return;
+  }
+  renderWorkflowEventPlaintext(event, { write: streams.data }, streams.colorize);
+}
+
+// Resolve a bubbled tool approval. With a policy, submit it (retrying transient
+// failures); without one, print the manual escape hatch and leave it for the user.
+// Each tool_call_id is handled once (mirrors Go's promptedToolCallIDs guard).
+async function maybeResolveApproval(
+  event: WorkflowExecutionEvent,
+  deps: WorkflowStreamDeps,
+  streams: WorkflowStreamStreams,
+  resolved: Set<string>,
+  signal: AbortSignal,
+): Promise<void> {
+  if (event.payload.case !== "approvalRequested") return;
+  const toolCallId = event.payload.value.toolCallId;
+  if (toolCallId === "" || resolved.has(toolCallId)) return;
+  resolved.add(toolCallId);
+
+  const escapeHatch = `stigmer execution approve ${deps.executionId} --tool-call ${toolCallId} --action approve`;
+  if (deps.defaultAction === ApprovalAction.UNSPECIFIED) {
+    streams.status(`  ⏳ Approval required for ${toolCallId}. Resolve it with:`);
+    streams.status(`     ${escapeHatch}`);
+    return;
+  }
+
+  await retryWithBackoff(signal, APPROVAL_RETRY_MAX_ATTEMPTS, APPROVAL_RETRY_BASE_DELAY_MS, async () => {
+    await deps.client.workflowExecution.submitApproval(
+      create(SubmitWorkflowApprovalInputSchema, {
+        executionId: deps.executionId,
+        toolCallId,
+        action: deps.defaultAction,
+      }),
+    );
+  });
+  streams.status(`  ✓ Approval auto-resolved (${approvalLabel(deps.defaultAction)}) for ${toolCallId}`);
+}
+
+// Final Get + a compact completion summary (port of Go's
+// displayWorkflowExecutionComplete, without the panel chrome — to stderr so
+// piped event output on stdout stays clean).
+async function runWorkflowEpilogue(
+  client: Stigmer,
+  executionId: string,
+  streams: WorkflowStreamStreams,
+): Promise<WorkflowExecution> {
+  const exec = await client.workflowExecution.get(executionId);
+  const style = styler(streams.colorize);
+  const status = exec.status;
+  const phase = status?.phase ?? ExecutionPhase.EXECUTION_PHASE_UNSPECIFIED;
+
+  streams.status("");
+  streams.status(summaryHeadline(phase, status?.error ?? "", style));
+
+  const duration = calculateDuration(status?.startedAt ?? "", status?.completedAt ?? "");
+  if (duration !== "-") streams.status(`  Duration:  ${duration}`);
+
+  const tasks = status?.tasks ?? [];
+  const counts = countTasks(tasks);
+  streams.status(`  Tasks:     ${tasks.length} total`);
+  if (counts.completed > 0) streams.status(`             ${counts.completed} completed`);
+  if (counts.failed > 0) streams.status(`             ${counts.failed} failed`);
+  if (counts.skipped > 0) streams.status(`             ${counts.skipped} skipped`);
+
+  return exec;
+}
+
+function summaryHeadline(phase: ExecutionPhase, error: string, style: Styler): string {
+  switch (phase) {
+    case ExecutionPhase.EXECUTION_COMPLETED:
+      return style.green("✓ Workflow completed");
+    case ExecutionPhase.EXECUTION_FAILED:
+      return style.red(`✗ Workflow failed${error !== "" ? `: ${error}` : ""}`);
+    case ExecutionPhase.EXECUTION_CANCELLED:
+      return style.yellow("Workflow cancelled");
+    case ExecutionPhase.EXECUTION_TERMINATED:
+      return style.yellow("Workflow terminated");
+    default:
+      return style.yellow(`Workflow exited (${formatWorkflowPhase(phase)})`);
+  }
+}
+
+interface TaskCounts {
+  completed: number;
+  failed: number;
+  skipped: number;
+}
+
+// Tally terminal task outcomes. Mirrors Go's countWorkflowTasks.
+function countTasks(tasks: readonly WorkflowTask[]): TaskCounts {
+  const counts: TaskCounts = { completed: 0, failed: 0, skipped: 0 };
+  for (const task of tasks) {
+    if (task.status === WorkflowTaskStatus.WORKFLOW_TASK_COMPLETED) counts.completed++;
+    else if (task.status === WorkflowTaskStatus.WORKFLOW_TASK_FAILED) counts.failed++;
+    else if (task.status === WorkflowTaskStatus.WORKFLOW_TASK_SKIPPED) counts.skipped++;
+  }
+  return counts;
+}
+
+function approvalLabel(action: ApprovalAction): string {
+  return (ApprovalAction[action] ?? "unspecified").toLowerCase();
+}
+
+function defaultStreams(): WorkflowStreamStreams {
+  return {
+    data: (line) => void process.stdout.write(line),
+    status: (line) => void process.stderr.write(`${line}\n`),
+    colorize: shouldColorize(process.stderr),
+  };
+}