@workflow-code/cli 0.2.4-20261011001.codex-cli-web → 0.2.4-20261011003.codex-cli-web

package/dist/{web-TJ2SME4G.js → web-O6FZ5URK.js}

@@ -17,15 +17,14 @@ import "./chunk-NSPRIPOP.js";
 
 // src/web.ts
 import { spawn as spawn3 } from "child_process";
-import path4 from "path";
+import path5 from "path";
 
 // src/web/server.ts
 import { createServer } from "http";
 import { createHash, randomBytes, timingSafeEqual } from "crypto";
-import { mkdir, readFile, rename, writeFile, realpath } from "fs/promises";
-import path2 from "path";
+import { mkdir, readFile as readFile2, rename, writeFile, realpath as realpath2 } from "fs/promises";
+import path3 from "path";
 import os from "os";
-import { pathToFileURL } from "url";
 import { spawn as spawn2 } from "child_process";
 
 // src/web/workflow-types.ts
@@ -668,28 +667,818 @@ var ConversationController = class {
   }
 };
 
+// src/web/workflow-workspace.ts
+function parseWorkflowArgs(text) {
+  const value = JSON.parse(text || "[]");
+  if (!Array.isArray(value) || !value.every((arg) => typeof arg === "string")) {
+    throw new Error("Run arguments must be a JSON string array.");
+  }
+  return value;
+}
+function migrateWorkflowHistory(sessions, activeId) {
+  const workspace = { version: 1, runs: [], drafts: {}, migratedConversations: true };
+  for (const session of sessions) {
+    let user;
+    for (const [index, message] of session.messages.entries()) {
+      if (message.role === "user") {
+        user = message;
+        continue;
+      }
+      const report = message.report;
+      const createdAt = message.createdAt ?? session.createdAt ?? 0;
+      workspace.runs.push({
+        id: message.id ?? `legacy-${session.id}-${index}`,
+        scopeId: session.id,
+        title: session.title,
+        entrypointId: message.entrypointId ?? user?.entrypointId,
+        createdAt,
+        updatedAt: session.updatedAt ?? createdAt,
+        status: message.status ?? report?.status ?? "success",
+        args: message.args ?? user?.args ?? [],
+        params: user?.input?.params ?? {},
+        policies: session.toolPermissionPolicies ?? {},
+        items: report?.output?.items ?? message.items ?? (message.content ? [{ content: message.content, contentType: "markdown" }] : []),
+        events: message.events ?? [],
+        nodes: report?.nodes ?? [],
+        logs: report?.logs ?? "",
+        files: [...user?.attachments ?? [], ...message.files ?? [], ...report?.files ?? []],
+        report,
+        pendingInput: message.pendingInput ?? report?.pendingUserInput,
+        resolvedInputs: message.resolvedInputs ?? report?.resolvedUserInputs ?? [],
+        error: message.error,
+        durationMs: message.durationMs,
+        tokenUsage: message.tokenUsage,
+        timers: message.timers,
+        migratedFrom: { sessionId: session.id, messageId: message.id }
+      });
+      if (session.id === activeId) {
+        workspace.selectedId = workspace.runs.at(-1).id;
+      }
+    }
+    for (const [entrypoint, values] of Object.entries(session.parameterValues ?? {})) {
+      workspace.drafts[entrypoint] = { scopeId: session.id, values, rawArgs: "[]", inputMode: "form", policies: session.toolPermissionPolicies ?? {} };
+    }
+  }
+  workspace.runs.sort((a, b) => b.createdAt - a.createdAt);
+  return workspace;
+}
+function workflowStorageReferences(value) {
+  const files = /* @__PURE__ */ new Set(), scopes = /* @__PURE__ */ new Set();
+  const visit = (item) => {
+    if (typeof item === "string") {
+      for (const id of item.match(/wf_[a-f0-9]{32}/g) ?? []) {
+        files.add(id);
+      }
+      if (/^[\[{]/.test(item.trim())) {
+        try {
+          visit(JSON.parse(item));
+        } catch {
+        }
+      }
+    } else if (Array.isArray(item)) {
+      item.forEach(visit);
+    } else if (item && typeof item === "object") {
+      const record2 = item;
+      if (typeof record2.scopeId === "string") {
+        scopes.add(record2.scopeId);
+      }
+      if (typeof record2.conversationId === "string") {
+        scopes.add(record2.conversationId);
+      }
+      Object.values(record2).forEach(visit);
+    }
+  };
+  visit(value);
+  return { files, scopes };
+}
+
+// src/web/workflow-controller.ts
+var WorkflowController = class {
+  constructor(project, runtime, saved, options) {
+    this.project = project;
+    this.runtime = runtime;
+    this.options = options;
+    this.workspace = { version: 1, runs: [], drafts: {}, ...saved };
+    for (const record2 of this.workspace.runs) {
+      delete record2.submittingInput;
+      if (record2.status === "running" || record2.status === "waiting_for_input") {
+        record2.status = "interrupted";
+        record2.error = "\u8FD0\u884C\u5DF2\u4E2D\u65AD";
+        this.clearTimers(record2);
+      }
+    }
+    this.workspace.occupiedId = this.workspace.runs.find((record2) => record2.id === saved.occupiedId && record2.pendingInput)?.id ?? this.workspace.runs.find((record2) => !!record2.pendingInput)?.id;
+    if (!this.workspace.runs.some((record2) => record2.id === this.workspace.selectedId)) {
+      delete this.workspace.selectedId;
+    }
+  }
+  project;
+  runtime;
+  options;
+  workspace;
+  task;
+  disposed = false;
+  eventSave;
+  get runs() {
+    return this.workspace.runs;
+  }
+  get current() {
+    return this.runs.find((record2) => record2.id === this.workspace.selectedId);
+  }
+  get running() {
+    return !!this.workspace.occupiedId;
+  }
+  get occupied() {
+    return this.runs.find((record2) => record2.id === this.workspace.occupiedId);
+  }
+  draft(entrypointId) {
+    return this.workspace.drafts[entrypointId ?? ""] ??= { scopeId: globalThis.crypto.randomUUID(), values: {}, rawArgs: "[]", inputMode: "form", policies: {} };
+  }
+  async persist() {
+    await this.options.save(JSON.parse(JSON.stringify({ ...this.workspace, runs: this.runs.map(({ submittingInput: _, ...record2 }) => record2) })));
+  }
+  changed() {
+    if (!this.disposed) {
+      this.options.changed();
+    }
+  }
+  scheduleSave() {
+    if (this.eventSave) {
+      return;
+    }
+    this.eventSave = setTimeout(() => {
+      this.eventSave = void 0;
+      void this.persist().catch((error) => this.options.log(String(error)));
+    }, 100);
+  }
+  async select(id) {
+    if (id && !this.runs.some((record2) => record2.id === id)) {
+      throw new Error("Run no longer exists.");
+    }
+    this.workspace.selectedId = id;
+    this.changed();
+    await this.persist();
+  }
+  async updateDraft(entrypointId, draft) {
+    Object.assign(this.draft(entrypointId), draft);
+    this.changed();
+    await this.persist();
+  }
+  assertAvailable() {
+    if (this.disposed) {
+      throw new Error("Workflow workspace has closed.");
+    }
+    if (this.running || this.task) {
+      throw new Error("A workflow is already running or waiting for input.");
+    }
+  }
+  async start(input) {
+    this.assertAvailable();
+    const parameters = workflowParameters(this.project, input.entrypointId);
+    const args = input.inputMode === "raw" ? parseWorkflowArgs(input.rawArgs ?? "[]") : (validateWorkflowValues(parameters.fields, input.params, input.states), workflowParamArgs(parameters.fields, input.params, input.states));
+    const files = await this.inputFiles([input.params, args]);
+    this.assertAvailable();
+    const draft = this.draft(input.entrypointId);
+    const id = globalThis.crypto.randomUUID(), now = Date.now();
+    const record2 = {
+      id,
+      scopeId: id,
+      entrypointId: input.entrypointId,
+      title: this.project.entrypoints.find((entry) => entry.id === input.entrypointId)?.title ?? this.project.name,
+      createdAt: now,
+      updatedAt: now,
+      status: "running",
+      args: [...args],
+      params: { ...input.params },
+      policies: structuredClone(draft.policies),
+      items: [],
+      events: [],
+      files,
+      nodes: [],
+      logs: "",
+      resolvedInputs: []
+    };
+    this.runs.unshift(record2);
+    this.workspace.selectedId = id;
+    draft.values = { ...input.params };
+    draft.rawArgs = input.rawArgs ?? draft.rawArgs;
+    draft.inputMode = input.inputMode ?? "form";
+    this.launch(record2);
+    await this.persist();
+    return record2;
+  }
+  async rerun(previousId) {
+    this.assertAvailable();
+    const previous = this.runs.find((record3) => record3.id === previousId);
+    if (!previous) {
+      throw new Error("Run no longer exists.");
+    }
+    const files = await this.inputFiles([previous.params, previous.args]);
+    this.assertAvailable();
+    const id = globalThis.crypto.randomUUID(), now = Date.now();
+    const record2 = {
+      id,
+      scopeId: id,
+      title: previous.title,
+      entrypointId: previous.entrypointId,
+      createdAt: now,
+      updatedAt: now,
+      status: "running",
+      args: [...previous.args],
+      params: structuredClone(previous.params),
+      policies: structuredClone(previous.policies),
+      items: [],
+      events: [],
+      files,
+      nodes: [],
+      logs: "",
+      resolvedInputs: []
+    };
+    this.runs.unshift(record2);
+    this.workspace.selectedId = id;
+    this.launch(record2);
+    await this.persist();
+    return record2;
+  }
+  async inputFiles(value) {
+    return Promise.all([...workflowStorageReferences(value).files].map(async (id) => (await this.runtime.readFile(this.project, id)).reference));
+  }
+  launch(record2) {
+    record2.status = "running";
+    record2.error = void 0;
+    record2.updatedAt = Date.now();
+    this.workspace.occupiedId = record2.id;
+    const task = { record: record2, cancelled: false, finished: Promise.resolve() };
+    this.task = task;
+    this.changed();
+    task.finished = this.execute(task).catch((error) => this.options.log(`Workflow persistence: ${String(error)}`));
+  }
+  async execute(task) {
+    const record2 = task.record, pending = record2.pendingInput;
+    try {
+      await this.persist();
+      if (task.cancelled || this.disposed) {
+        throw new Error("Stopped.");
+      }
+      const report = await this.runtime.run({
+        project: this.project,
+        conversationId: record2.scopeId,
+        args: record2.args,
+        entrypointId: record2.entrypointId,
+        runId: record2.id,
+        toolPermissionPolicies: record2.policies,
+        resolvedInputs: [...record2.resolvedInputs, ...record2.submittingInput ? [record2.submittingInput] : []],
+        resumeAfterRequestId: record2.submittingInput?.requestId
+      }, (event) => {
+        if (task.cancelled || this.disposed || this.task !== task) {
+          return;
+        }
+        record2.events.push(event);
+        if (event.type === "node_chunk") {
+          applyOutputChunk(record2.items, event.chunk);
+        }
+        if (event.type === "node_started" || event.type === "node_finished") {
+          const index = record2.nodes.findIndex((node2) => node2.executionId === event.executionId);
+          const node = { ...index >= 0 ? record2.nodes[index] : {}, ...event, name: event.nodeName, status: event.status ?? "running" };
+          if (index >= 0) {
+            record2.nodes[index] = node;
+          } else {
+            record2.nodes.push(node);
+          }
+        }
+        if (event.type === "runtime_log" && typeof event.text === "string") {
+          record2.logs = (record2.logs + event.text).slice(-1e5);
+        }
+        if (event.type === "user_input_requested") {
+          record2.pendingInput = event;
+        }
+        if (event.type === "user_input_resolved") {
+          this.confirmInput(record2, event);
+          if (record2.pendingInput?.requestId === event.requestId) {
+            delete record2.pendingInput;
+          }
+        }
+        if (event.type === "token_usage_updated") {
+          record2.tokenUsage = { enabled: true, display: workflowParameters(this.project, record2.entrypointId).tokenUsage?.display !== false, run: event.usage };
+        }
+        if (event.type === "file_created") {
+          record2.files.push(event.file);
+        }
+        if (event.type === "timer_started" || event.type === "timer_finished") {
+          const timer = event.timer;
+          record2.timers = [...(record2.timers ?? []).filter((entry) => entry.timerId !== timer.timerId), timer];
+        }
+        record2.updatedAt = Date.now();
+        this.changed();
+        this.scheduleSave();
+      });
+      record2.report = report;
+      record2.durationMs = report.durationMs;
+      record2.status = report.status;
+      if (report.output) {
+        record2.items = report.output.items ?? [];
+      }
+      record2.nodes = report.nodes ?? record2.nodes;
+      record2.logs = report.logs ?? record2.logs;
+      record2.tokenUsage = report.tokenUsage ?? record2.tokenUsage;
+      record2.timers = report.timers ?? record2.timers;
+      record2.files = [...new Map([...record2.files, ...report.files ?? []].map((file) => [file.id, file])).values()];
+      record2.pendingInput = report.status === "waiting_for_input" ? report.pendingUserInput : void 0;
+      for (const resolved of report.resolvedUserInputs ?? []) {
+        this.confirmInput(record2, resolved);
+      }
+      if (record2.submittingInput && report.status === "success") {
+        this.confirmInput(record2, record2.submittingInput);
+      }
+      if (report.status === "failed") {
+        record2.error = report.result?.error?.message ?? "Workflow failed.";
+      }
+      if (record2.submittingInput && pending && report.status === "failed") {
+        record2.status = "waiting_for_input";
+        record2.pendingInput = pending;
+      }
+    } catch (error) {
+      record2.error = error instanceof Error ? error.message : String(error);
+      record2.status = task.cancelled ? this.disposed ? "interrupted" : "aborted" : record2.submittingInput && pending ? "waiting_for_input" : "failed";
+      if (record2.status === "waiting_for_input") {
+        record2.pendingInput = pending;
+      } else if (this.disposed) {
+        record2.pendingInput ??= pending;
+      } else {
+        delete record2.pendingInput;
+      }
+    } finally {
+      if (task.cancelled) {
+        record2.status = this.disposed ? "interrupted" : "aborted";
+        if (!this.disposed) {
+          delete record2.pendingInput;
+        }
+      }
+      delete record2.submittingInput;
+      if (!record2.pendingInput || this.disposed) {
+        delete this.workspace.occupiedId;
+      }
+      if (record2.status !== "running") {
+        this.clearTimers(record2);
+      }
+      record2.updatedAt = Date.now();
+      this.task = void 0;
+      this.changed();
+      await this.persist();
+    }
+  }
+  clearTimers(record2) {
+    record2.timers = record2.timers?.map((timer) => timer.status === "running" ? { ...timer, status: "cleared", endedAt: (/* @__PURE__ */ new Date()).toISOString(), durationMs: Math.max(0, Date.now() - Date.parse(timer.startedAt)) } : timer);
+  }
+  confirmInput(record2, resolved) {
+    const previous = record2.resolvedInputs.find((input) => input.requestId === resolved.requestId) ?? (record2.submittingInput?.requestId === resolved.requestId ? record2.submittingInput : void 0);
+    record2.resolvedInputs = [
+      ...record2.resolvedInputs.filter((input) => input.requestId !== resolved.requestId),
+      { ...previous, ...resolved, precedingOutputItemIds: previous?.precedingOutputItemIds ?? resolved.precedingOutputItemIds }
+    ];
+    if (record2.submittingInput?.requestId === resolved.requestId) {
+      delete record2.submittingInput;
+    }
+  }
+  async resume(id, requestId, values) {
+    if (this.task || this.disposed) {
+      throw new Error("Workflow is already running.");
+    }
+    const record2 = this.runs.find((record3) => record3.id === id && record3.pendingInput?.requestId === requestId);
+    if (!record2?.pendingInput) {
+      throw new Error("Input request is no longer available.");
+    }
+    if (this.workspace.occupiedId && this.workspace.occupiedId !== id) {
+      throw new Error("Another workflow is waiting for input.");
+    }
+    const request = record2.pendingInput;
+    const form = Object.fromEntries(request.params.map((field) => [field.name, workflowFormValue(field, values[field.name] ?? request.defaultValues?.[field.name])]));
+    record2.submittingInput = {
+      requestId,
+      nodeName: request.nodeName,
+      values: resolvedWorkflowValues(request.params, form),
+      submittedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      request,
+      precedingOutputItemIds: record2.items.map((item, index) => item.id ?? String(index))
+    };
+    this.launch(record2);
+    await this.persist();
+  }
+  async stop(reason = "Stopped.") {
+    const record2 = this.occupied;
+    if (!record2) {
+      return;
+    }
+    if (this.task) {
+      this.task.cancelled = true;
+      this.runtime.cancel(record2.id);
+      await this.task.finished;
+    }
+    record2.status = "aborted";
+    record2.error = reason;
+    delete record2.pendingInput;
+    delete this.workspace.occupiedId;
+    this.clearTimers(record2);
+    this.changed();
+    await this.persist();
+  }
+  async remove(id) {
+    if (this.workspace.occupiedId === id || this.task?.record.id === id) {
+      throw new Error("Stop the workflow before deleting its record.");
+    }
+    const record2 = this.runs.find((record3) => record3.id === id);
+    if (!record2) {
+      throw new Error("Run no longer exists.");
+    }
+    const other = workflowStorageReferences([this.runs.filter((item) => item !== record2), this.workspace.drafts, this.options.legacy ?? []]);
+    const own = workflowStorageReferences(record2);
+    for (const id2 of other.files) {
+      const file = await this.runtime.readFile(this.project, id2).catch(() => void 0);
+      if (file?.reference.conversationId) {
+        other.scopes.add(file.reference.conversationId);
+      }
+    }
+    const owners = /* @__PURE__ */ new Map();
+    for (const fileId of own.files) {
+      if (other.files.has(fileId)) {
+        continue;
+      }
+      const file = await this.runtime.readFile(this.project, fileId).catch(() => void 0);
+      if (file?.reference.conversationId) {
+        const ids = owners.get(file.reference.conversationId) ?? [];
+        ids.push(fileId);
+        owners.set(file.reference.conversationId, ids);
+      }
+    }
+    for (const [scope, ids] of owners) {
+      await this.runtime.deleteFiles(this.project, scope, ids);
+    }
+    if (!other.scopes.has(record2.scopeId)) {
+      await this.runtime.deleteConversation(this.project, record2.scopeId);
+    }
+    this.runs.splice(this.runs.indexOf(record2), 1);
+    if (this.workspace.selectedId === id) {
+      delete this.workspace.selectedId;
+    }
+    this.changed();
+    await this.persist();
+  }
+  async idle() {
+    if (this.task) {
+      await this.task.finished;
+    }
+  }
+  dispose() {
+    this.disposed = true;
+    clearTimeout(this.eventSave);
+    if (this.task) {
+      this.task.cancelled = true;
+      this.runtime.cancel(this.task.record.id);
+    } else if (this.occupied) {
+      this.occupied.status = "interrupted";
+      this.occupied.error = "Host closed.";
+      this.clearTimers(this.occupied);
+      delete this.workspace.occupiedId;
+    }
+  }
+};
+
+// src/web/resource-cards.ts
+var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+var string = (value) => typeof value === "string" && value.trim() ? value.trim() : void 0;
+function conversationResourceCards(items, projectId, conversationId) {
+  const cards = /* @__PURE__ */ new Map();
+  for (const [index, item] of items.entries()) {
+    if (!["agent-part", "opencode-part"].includes(String(item.metadata?.kind)) || item.metadata?.partType !== "tool") {
+      continue;
+    }
+    const content = record(item.content);
+    if (content?.status !== "success") {
+      continue;
+    }
+    let output = record(content.output);
+    if (Array.isArray(output?.content) && output.content.length === 1) {
+      try {
+        output = record(JSON.parse(String(record(output.content[0])?.text)));
+      } catch {
+      }
+    }
+    let descriptor = record(record(output?.details)?.resourceCard);
+    const input = record(content.input) ?? {};
+    const tool = string(content.tool) ?? "";
+    if (tool === "workflow-ui_present_card") {
+      const presentation = output?.action ? output : input;
+      if (presentation.action === "remove") {
+        cards.delete(String(presentation.cardId));
+        continue;
+      }
+      if (presentation.action !== "upsert") {
+        continue;
+      }
+      descriptor = presentation;
+    }
+    if (!descriptor) {
+      const target2 = { source: "local", projectId, conversationId };
+      let kind2;
+      if (tool === "workflow-kv_kv_store" || /workflow-desktop_(?:read|list|write)_project_kv/.test(tool)) {
+        kind2 = "kv";
+        Object.assign(target2, { projectId: input.projectId ?? projectId, key: input.key, scope: input.scope ?? "project", conversationId: input.conversationId ?? conversationId });
+      } else if (tool === "workflow-knowledge_knowledge_documents" || /workflow-desktop_(?:query|mutate)_project_knowledge/.test(tool)) {
+        kind2 = "knowledge";
+        Object.assign(target2, { projectId: input.projectId ?? projectId, documentId: input.documentId ?? record(output?.document)?.id });
+      } else if (tool === "read" || tool === "workflow-desktop_open_dock_tool" && input.tool === "files") {
+        kind2 = "file";
+        target2.filePath = input.filePath ?? input.path;
+      } else if (tool === "workflow-desktop_open_project" && input.kind === "project") {
+        kind2 = "project";
+        target2.projectId = input.targetId;
+      } else if (tool === "workflow-desktop_open_dock_tool") {
+        if (input.tool === "browser") {
+          kind2 = "browser";
+          target2.url = input.url;
+        }
+        if (input.tool === "preview") {
+          kind2 = "kanban";
+        }
+        if (input.tool === "open-project" && input.openedProjectKind === "project") {
+          kind2 = "project";
+          target2.projectId = input.openedProjectId;
+        }
+      }
+      if (!kind2) {
+        continue;
+      }
+      descriptor = { kind: kind2, target: target2, title: record(output?.document)?.title };
+    }
+    const kind = descriptor.kind;
+    if (!["kv", "knowledge", "project", "browser", "file", "kanban"].includes(kind)) {
+      continue;
+    }
+    const target = Object.fromEntries(Object.entries(record(descriptor.target) ?? {}).filter((entry) => typeof entry[1] === "string" && entry[1].length < 8192));
+    if (target.source === "current") {
+      target.source = "local";
+      target.projectId = projectId;
+    }
+    if (target.source && !["local", "server"].includes(target.source)) {
+      continue;
+    }
+    if (kind === "browser") {
+      try {
+        const url = new URL(target.url);
+        if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) {
+          continue;
+        }
+      } catch {
+        continue;
+      }
+    } else {
+      target.source ??= "local";
+      target.projectId ??= projectId;
+      if (target.scope === "conversation") {
+        target.conversationId ??= conversationId;
+      }
+      if (kind === "file" && (!target.filePath || /^(?:[\\/]|[a-z]:)|(?:^|[\\/])\.\.(?:[\\/]|$)/i.test(target.filePath))) {
+        continue;
+      }
+    }
+    const id = string(descriptor.cardId) ?? `${kind}:${JSON.stringify(target)}`;
+    const title = (string(descriptor.title) ?? target.key ?? target.documentId ?? target.filePath ?? target.url ?? target.projectId ?? kind).slice(0, 200);
+    cards.set(id, { id, kind, title, target, itemId: item.id ?? String(index) });
+  }
+  return [...cards.values()];
+}
+
+// src/web/workflow-actions.ts
+import { readFile, realpath } from "fs/promises";
+import path from "path";
+function createWorkflowActions(controller, runtime, project, revision, changed) {
+  const states = /* @__PURE__ */ new Map();
+  const epochs = /* @__PURE__ */ new Map();
+  let limit = 30, query = "";
+  const entry = (id) => {
+    const value = typeof id === "string" && id ? id : project.defaultEntrypoint ?? project.entrypoints[0]?.id;
+    if (value && !project.entrypoints.some((item) => item.id === value)) {
+      throw new Error("Unknown entrypoint.");
+    }
+    return value;
+  };
+  const values = (supplied, id) => {
+    if (!supplied || typeof supplied !== "object" || Array.isArray(supplied) || Object.values(supplied).some((value) => typeof value !== "string" && !(Array.isArray(value) && value.every((item) => typeof item === "string")))) {
+      throw new Error("Invalid parameters.");
+    }
+    return Object.fromEntries(workflowParameters(project, id).fields.map((field) => [
+      field.name,
+      workflowParamValue(field, supplied[field.name] ?? field.defaultValue ?? (field.type === "boolean" ? "false" : ""))
+    ]));
+  };
+  const resolve = async (message, id) => {
+    const key = id ?? "", parameters = workflowParameters(project, id);
+    const params = values(message.params ?? controller.draft(id).values, id);
+    const mode = message.inputMode === "raw" ? "raw" : "form";
+    const epoch = (epochs.get(key) ?? 0) + 1;
+    epochs.set(key, epoch);
+    const auth = revision();
+    await controller.updateDraft(id, { values: params, rawArgs: String(message.rawArgs ?? controller.draft(id).rawArgs).slice(0, 1e5), inputMode: mode });
+    const args = mode === "raw" ? parseWorkflowArgs(String(message.rawArgs ?? "[]")) : workflowParamArgs(parameters.fields, params, states.get(key));
+    const trigger = message.trigger?.kind === "param" && parameters.fields.some((field) => field.name === message.trigger.paramName) ? { kind: "param", paramName: String(message.trigger.paramName) } : { kind: message.trigger?.kind === "input" ? "input" : "init" };
+    const result = parameters.paramResolver?.enabled ? await runtime.resolveParams(project, { args, inputMode: mode, draftText: "", trigger }, id) : { params: {} };
+    if (epoch !== epochs.get(key) || auth !== revision()) {
+      throw new Error("Parameters changed. Try again.");
+    }
+    const next = { ...states.get(key) ?? {} };
+    for (const [name, patch] of Object.entries(result.params ?? {})) {
+      if (!parameters.fields.some((field) => field.name === name)) {
+        continue;
+      }
+      next[name] = { ...next[name], ...patch, options: { ...next[name]?.options, ...patch.options } };
+      if (patch.value !== void 0) {
+        params[name] = patch.value === null ? workflowParamValue(parameters.fields.find((field) => field.name === name)) : patch.value;
+      }
+    }
+    states.set(key, next);
+    await controller.updateDraft(id, { values: params, rawArgs: String(message.rawArgs ?? controller.draft(id).rawArgs).slice(0, 1e5), inputMode: mode });
+    return { params, states: next };
+  };
+  const state = () => {
+    const filtered = controller.runs.filter((record2) => !query || `${record2.title} ${record2.entrypointId ?? ""} ${record2.args.join(" ")}`.toLocaleLowerCase().includes(query.toLocaleLowerCase()));
+    const runs = filtered.slice(0, limit).map(({ id, title, entrypointId, status, createdAt, updatedAt, durationMs }) => ({ id, title, entrypointId, status, createdAt, updatedAt, durationMs }));
+    return {
+      runs,
+      selectedId: controller.workspace.selectedId,
+      run: controller.current,
+      occupiedId: controller.workspace.occupiedId,
+      occupiedRun: controller.occupied,
+      running: controller.running,
+      drafts: controller.workspace.drafts,
+      history: { pageSize: 30, total: filtered.length, hasMore: filtered.length > limit, query },
+      migratedConversations: controller.workspace.migratedConversations
+    };
+  };
+  return {
+    state,
+    invalidate: () => {
+      states.clear();
+      for (const [key, value] of epochs) {
+        epochs.set(key, value + 1);
+      }
+    },
+    async handle(message) {
+      const replies = [];
+      const id = entry(message.entrypointId);
+      if (message.projectUri && message.projectUri !== project.uri) {
+        throw new Error("Project changed.");
+      }
+      switch (message.type) {
+        case "ready":
+          break;
+        case "workflow-history": {
+          const nextQuery = String(message.query ?? "").slice(0, 200);
+          if (query !== nextQuery || !message.more) {
+            limit = 30;
+          } else {
+            limit = Math.min(limit + 30, 3e4);
+          }
+          query = nextQuery;
+          changed();
+          break;
+        }
+        case "workflow-select":
+          await controller.select(message.id ? String(message.id) : void 0);
+          break;
+        case "workflow-draft": {
+          const draft = { values: values(message.params ?? {}, id) };
+          if (message.inputMode !== void 0) {
+            draft.inputMode = message.inputMode === "raw" ? "raw" : "form";
+          }
+          if (message.rawArgs !== void 0) {
+            draft.rawArgs = String(message.rawArgs).slice(0, 1e5);
+          }
+          epochs.set(id ?? "", (epochs.get(id ?? "") ?? 0) + 1);
+          await controller.updateDraft(id, draft);
+          break;
+        }
+        case "resolve": {
+          try {
+            const result = await resolve(message, id);
+            replies.push({ type: "params", projectUri: project.uri, entrypointId: id, requestId: message.requestId, params: result.states, values: result.params });
+          } catch (error) {
+            replies.push({ type: "params", projectUri: project.uri, entrypointId: id, requestId: message.requestId, error: error.message });
+          }
+          break;
+        }
+        case "workflow-run": {
+          if (controller.running) {
+            throw new Error("A workflow is already running or waiting for input.");
+          }
+          const resolved = await resolve(message, id);
+          const record2 = await controller.start({
+            entrypointId: id,
+            params: resolved.params,
+            states: resolved.states,
+            inputMode: message.inputMode === "raw" ? "raw" : "form",
+            rawArgs: String(message.rawArgs ?? "[]")
+          });
+          replies.push({ type: "workflow-started", id: record2.id });
+          break;
+        }
+        case "workflow-stop":
+          await controller.stop();
+          break;
+        case "workflow-resume":
+          await controller.resume(String(message.id), String(message.requestId), message.values ?? {});
+          break;
+        case "workflow-rerun":
+          await controller.rerun(String(message.id));
+          break;
+        case "workflow-delete":
+          await controller.remove(String(message.id));
+          break;
+        case "workflow-export": {
+          const record2 = controller.runs.find((record3) => record3.id === message.id);
+          if (!record2) {
+            throw new Error("Run no longer exists.");
+          }
+          replies.push({ type: "download", name: `workflow-${record2.id}.json`, content: JSON.stringify(redactWorkflowData(record2), null, 2) });
+          break;
+        }
+        case "tool-policy": {
+          const tools = workflowParameters(project, id).tools ?? [];
+          const policies = Object.fromEntries(tools.map((tool) => [tool.name, {
+            enabled: typeof message.policies?.[tool.name]?.enabled === "boolean" ? message.policies[tool.name].enabled : tool.enabled,
+            autoApprove: typeof message.policies?.[tool.name]?.autoApprove === "boolean" ? message.policies[tool.name].autoApprove : tool.autoApprove
+          }]));
+          await controller.updateDraft(id, { policies });
+          break;
+        }
+        case "upload": {
+          if (!Array.isArray(message.files) || message.files.length > 32 || message.files.some((file) => typeof file?.name !== "string" || typeof file.data !== "string" || file.path !== void 0)) {
+            throw new Error("Invalid upload.");
+          }
+          const record2 = message.runId ? controller.runs.find((record3) => record3.id === message.runId) : void 0;
+          if (message.runId && (!record2?.pendingInput || record2.pendingInput.requestId !== message.requestId || controller.workspace.occupiedId !== record2.id)) {
+            throw new Error("Input request changed.");
+          }
+          const files = await runtime.uploadFiles(project, record2?.scopeId ?? controller.draft(id).scopeId, message.files);
+          if (record2) {
+            record2.files.push(...files);
+            await controller.persist();
+            changed();
+          }
+          replies.push({ type: "attachments", entrypointId: id, runId: message.runId, requestId: message.requestId, paramName: message.paramName, files });
+          break;
+        }
+        case "resource": {
+          const run = controller.runs.find((record2) => record2.id === message.runId);
+          if (!run) {
+            throw new Error("Run no longer exists.");
+          }
+          const card = conversationResourceCards(run.items, project.id, run.scopeId).find((card2) => card2.id === message.cardId);
+          if (!card || card.target.projectId && card.target.projectId !== project.id || card.target.source === "server") {
+            throw new Error("Resource is outside this project.");
+          }
+          if (card.kind === "kv" || card.kind === "knowledge") {
+            replies.push({ type: "preview", title: card.title, content: await runtime.readResource(project, run.scopeId, card.kind, card.target) });
+          } else if (card.kind === "file") {
+            const root = await realpath(project.folderPath), filename = await realpath(path.resolve(root, card.target.filePath)), relative = path.relative(root, filename);
+            if (relative.startsWith("..") || path.isAbsolute(relative)) {
+              throw new Error("File is outside this project.");
+            }
+            replies.push({ type: "preview", title: card.title, content: await readFile(filename, "utf8") });
+          } else {
+            throw new Error("This resource requires an editor host.");
+          }
+          break;
+        }
+        default:
+          throw new Error(`Unsupported workflow action: ${message.type}`);
+      }
+      return replies;
+    }
+  };
+}
+
 // src/web/runtime.ts
 import { spawn } from "child_process";
 import { existsSync, readFileSync } from "fs";
-import path from "path";
+import path2 from "path";
 import { fileURLToPath } from "url";
 function cliRoot() {
-  let directory = path.dirname(fileURLToPath(import.meta.url));
+  let directory = path2.dirname(fileURLToPath(import.meta.url));
   for (let depth = 0; depth < 8; depth++) {
     try {
-      if (JSON.parse(readFileSync(path.join(directory, "package.json"), "utf8")).name === "@workflow-code/cli") {
+      if (JSON.parse(readFileSync(path2.join(directory, "package.json"), "utf8")).name === "@workflow-code/cli") {
         return directory;
       }
     } catch {
     }
-    directory = path.dirname(directory);
+    directory = path2.dirname(directory);
   }
   throw new Error("Cannot locate the CLI installation.");
 }
 function createWebRuntime(projectDir, storageDir, connection) {
   const root = cliRoot();
-  const builtWorker = path.join(root, "dist/web/worker.mjs");
-  const worker = existsSync(builtWorker) ? builtWorker : path.join(root, "src/web/worker.mjs");
+  const builtWorker = path2.join(root, "dist/web/worker.mjs");
+  const worker = existsSync(builtWorker) ? builtWorker : path2.join(root, "src/web/worker.mjs");
   const children = /* @__PURE__ */ new Set();
   const active = /* @__PURE__ */ new Map();
   let disposed = false;
@@ -711,7 +1500,7 @@ function createWebRuntime(projectDir, storageDir, connection) {
       WORKFLOW_SERVER_TOKEN: "",
       WORKFLOW_LLM_SERVER_URL: auth?.serverUrl ?? "",
       WORKFLOW_LLM_SERVER_TOKEN: auth?.accessToken ?? "",
-      WORKFLOW_CLI_AUTH_DIR: path.join(storageDir, "runtime-auth")
+      WORKFLOW_CLI_AUTH_DIR: path2.join(storageDir, "runtime-auth")
     };
     for (const key of [
       "TSX_TSCONFIG_PATH",
@@ -742,7 +1531,8 @@ function createWebRuntime(projectDir, storageDir, connection) {
     child.stdout.setEncoding("utf8");
     child.stderr.setEncoding("utf8");
     child.stderr.on("data", (chunk) => {
-      stderr = (stderr + chunk).slice(-12e3);
+      stderr = (stderr + chunk).slice(-1e5);
+      onEvent?.({ type: "runtime_log", text: redactWorkflowData(chunk, [auth?.accessToken ?? ""]), runId: request.runId });
     });
     child.stdout.on("data", (chunk) => {
       buffer += chunk;
@@ -795,7 +1585,7 @@ function createWebRuntime(projectDir, storageDir, connection) {
       }
     });
     child.stdin.on("error", () => void 0);
-    child.stdin.end(JSON.stringify({ ...request, storageDir }));
+    child.stdin.end(JSON.stringify({ ...request, storageDir, runtimeProjectDir: projectDir }));
   });
   return {
     available: true,
@@ -832,111 +1622,6 @@ function createWebRuntime(projectDir, storageDir, connection) {
   };
 }
 
-// src/web/resource-cards.ts
-var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-var string = (value) => typeof value === "string" && value.trim() ? value.trim() : void 0;
-function conversationResourceCards(items, projectId, conversationId) {
-  const cards = /* @__PURE__ */ new Map();
-  for (const [index, item] of items.entries()) {
-    if (!["agent-part", "opencode-part"].includes(String(item.metadata?.kind)) || item.metadata?.partType !== "tool") {
-      continue;
-    }
-    const content = record(item.content);
-    if (content?.status !== "success") {
-      continue;
-    }
-    let output = record(content.output);
-    if (Array.isArray(output?.content) && output.content.length === 1) {
-      try {
-        output = record(JSON.parse(String(record(output.content[0])?.text)));
-      } catch {
-      }
-    }
-    let descriptor = record(record(output?.details)?.resourceCard);
-    const input = record(content.input) ?? {};
-    const tool = string(content.tool) ?? "";
-    if (tool === "workflow-ui_present_card") {
-      const presentation = output?.action ? output : input;
-      if (presentation.action === "remove") {
-        cards.delete(String(presentation.cardId));
-        continue;
-      }
-      if (presentation.action !== "upsert") {
-        continue;
-      }
-      descriptor = presentation;
-    }
-    if (!descriptor) {
-      const target2 = { source: "local", projectId, conversationId };
-      let kind2;
-      if (tool === "workflow-kv_kv_store" || /workflow-desktop_(?:read|list|write)_project_kv/.test(tool)) {
-        kind2 = "kv";
-        Object.assign(target2, { projectId: input.projectId ?? projectId, key: input.key, scope: input.scope ?? "project", conversationId: input.conversationId ?? conversationId });
-      } else if (tool === "workflow-knowledge_knowledge_documents" || /workflow-desktop_(?:query|mutate)_project_knowledge/.test(tool)) {
-        kind2 = "knowledge";
-        Object.assign(target2, { projectId: input.projectId ?? projectId, documentId: input.documentId ?? record(output?.document)?.id });
-      } else if (tool === "read" || tool === "workflow-desktop_open_dock_tool" && input.tool === "files") {
-        kind2 = "file";
-        target2.filePath = input.filePath ?? input.path;
-      } else if (tool === "workflow-desktop_open_project" && input.kind === "project") {
-        kind2 = "project";
-        target2.projectId = input.targetId;
-      } else if (tool === "workflow-desktop_open_dock_tool") {
-        if (input.tool === "browser") {
-          kind2 = "browser";
-          target2.url = input.url;
-        }
-        if (input.tool === "preview") {
-          kind2 = "kanban";
-        }
-        if (input.tool === "open-project" && input.openedProjectKind === "project") {
-          kind2 = "project";
-          target2.projectId = input.openedProjectId;
-        }
-      }
-      if (!kind2) {
-        continue;
-      }
-      descriptor = { kind: kind2, target: target2, title: record(output?.document)?.title };
-    }
-    const kind = descriptor.kind;
-    if (!["kv", "knowledge", "project", "browser", "file", "kanban"].includes(kind)) {
-      continue;
-    }
-    const target = Object.fromEntries(Object.entries(record(descriptor.target) ?? {}).filter((entry) => typeof entry[1] === "string" && entry[1].length < 8192));
-    if (target.source === "current") {
-      target.source = "local";
-      target.projectId = projectId;
-    }
-    if (target.source && !["local", "server"].includes(target.source)) {
-      continue;
-    }
-    if (kind === "browser") {
-      try {
-        const url = new URL(target.url);
-        if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) {
-          continue;
-        }
-      } catch {
-        continue;
-      }
-    } else {
-      target.source ??= "local";
-      target.projectId ??= projectId;
-      if (target.scope === "conversation") {
-        target.conversationId ??= conversationId;
-      }
-      if (kind === "file" && (!target.filePath || /^(?:[\\/]|[a-z]:)|(?:^|[\\/])\.\.(?:[\\/]|$)/i.test(target.filePath))) {
-        continue;
-      }
-    }
-    const id = string(descriptor.cardId) ?? `${kind}:${JSON.stringify(target)}`;
-    const title = (string(descriptor.title) ?? target.key ?? target.documentId ?? target.filePath ?? target.url ?? target.projectId ?? kind).slice(0, 200);
-    cards.set(id, { id, kind, title, target, itemId: item.id ?? String(index) });
-  }
-  return [...cards.values()];
-}
-
 // src/web/account-auth.ts
 async function loginWebAccount(serverUrl, email, password) {
   if (!email.trim() || !password) {
@@ -983,12 +1668,47 @@ async function loginWebAccount(serverUrl, email, password) {
   }
 }
 
+// src/web/assistant-project.ts
+import { pathToFileURL } from "url";
+var ASSISTANT_PROTOCOL_VERSION = 1;
+var assistantTools = /* @__PURE__ */ new Set([
+  "read",
+  "write",
+  "edit",
+  "bash",
+  "grep",
+  "find",
+  "ls",
+  "skill",
+  "workflow-memory_global_memory",
+  "workflow-ui_present_card"
+]);
+async function inspectWebProject(runtime, projectDir, host) {
+  if (host?.assistant && !host.assistantProjectDir) {
+    throw new Error("A dedicated assistant project is required.");
+  }
+  const inspection = await runtime.inspect([host?.assistantProjectDir ?? projectDir]);
+  return {
+    ...inspection,
+    assistantProtocolVersion: host?.assistant ? ASSISTANT_PROTOCOL_VERSION : void 0,
+    projects: inspection.projects.map((descriptor) => {
+      const project = { ...descriptor, uri: pathToFileURL(descriptor.folderPath).href };
+      if (host?.assistant) {
+        project.assistant = host.assistant;
+        project.uri = `studio-assistant:${encodeURIComponent(project.assistant.workdir)}`;
+        project.requiresLogin = true;
+        project.fields = project.fields.map((field) => field.name === "permissionPolicy" ? { ...field, defaultValue: "workspace" } : field);
+        project.tools = project.tools?.filter((tool) => assistantTools.has(tool.name));
+      }
+      return project;
+    })
+  };
+}
+
 // src/web/server.ts
 async function startWebServer(options) {
-  const projectDir = await realpath(path2.resolve(options.projectDir));
-  const key = createHash("sha256").update(options.host?.assistant ? `assistant:${options.host.assistant.workdir}` : projectDir).digest("hex").slice(0, 24);
-  const storageDir = path2.resolve(options.dataDir ?? path2.join(os.homedir(), ".workflow-code", "web"));
-  const historyPath = path2.join(storageDir, key, "conversations.json");
+  const projectDir = await realpath2(path3.resolve(options.projectDir));
+  const storageDir = path3.resolve(options.dataDir ?? path3.join(os.homedir(), ".workflow-code", "web"));
   const clients = /* @__PURE__ */ new Set();
   let connection;
   let account = { status: "signed-out", serverUrl: "http://localhost:7126", revision: 0 };
@@ -999,12 +1719,13 @@ async function startWebServer(options) {
   let hostConnection = options.host?.connection;
   let hostManaged = !!hostConnection;
   let authEpoch = 0;
+  let authenticationInitialized = false;
   let authCheck;
   const sensitiveTokens = /* @__PURE__ */ new Set();
   const runtime = options.runtime ?? createWebRuntime(projectDir, storageDir, () => connection);
   let inspected;
   try {
-    inspected = await runtime.inspect([projectDir]);
+    inspected = await inspectWebProject(runtime, projectDir, options.host);
   } catch (error) {
     runtime.dispose();
     throw error;
@@ -1021,18 +1742,12 @@ async function startWebServer(options) {
     runtime.dispose();
     throw new Error("workflow-code web currently supports Conversation and Workflow projects.");
   }
-  const project = { ...descriptor, uri: pathToFileURL(projectDir).href };
-  if (options.host?.assistant) {
-    project.assistant = options.host.assistant;
-    project.uri = `studio-assistant:${encodeURIComponent(project.assistant.workdir)}`;
-    project.requiresLogin = true;
-    project.fields = project.fields.map((field) => field.name === "permissionPolicy" ? { ...field, defaultValue: "workspace" } : field);
-    const supported = /* @__PURE__ */ new Set(["read", "write", "edit", "bash", "grep", "find", "ls", "skill", "workflow-memory_global_memory", "workflow-ui_present_card"]);
-    project.tools = project.tools?.filter((tool) => supported.has(tool.name));
-  }
+  const project = descriptor;
+  const key = createHash("sha256").update(project.assistant ? `assistant:${project.id}:${project.assistant.workdir}` : projectDir).digest("hex").slice(0, 24);
+  const historyPath = path3.join(storageDir, key, "conversations.json");
   let saved = {};
   try {
-    saved = JSON.parse(await readFile(historyPath, "utf8"));
+    saved = JSON.parse(await readFile2(historyPath, "utf8"));
   } catch (error) {
     if (error.code !== "ENOENT") {
       runtime.dispose();
@@ -1042,6 +1757,7 @@ async function startWebServer(options) {
   let pendingSave = Promise.resolve();
   let broadcastTimer;
   let authRevision = 0;
+  const isWorkflow = project.projectType === "workflow";
   const parameterStates = /* @__PURE__ */ new Map();
   const parameterEpochs = /* @__PURE__ */ new Map();
   const publicFile = (file) => ({ ...file, previewUrl: `/api/file/${encodeURIComponent(file.id)}` });
@@ -1058,7 +1774,13 @@ async function startWebServer(options) {
     }
     return value;
   };
-  const state = () => publicValue(redactWorkflowData({ type: "state", project, sessions: controller.sessions, activeId: controller.activeId, running: controller.running, parameterValues: controller.current.parameterValues ?? {}, account, authenticationRevision: authRevision }, [...sensitiveTokens]));
+  const state = () => publicValue(redactWorkflowData({
+    type: "state",
+    project,
+    ...isWorkflow ? workflowActions.state() : { sessions: controller.sessions, activeId: controller.activeId, running: controller.running, parameterValues: controller.current.parameterValues ?? {} },
+    account,
+    authenticationRevision: authRevision
+  }, [...sensitiveTokens]));
   const broadcast = () => {
     if (broadcastTimer) {
       return;
@@ -1073,14 +1795,14 @@ async function startWebServer(options) {
       }
     }, 30);
   };
-  const controller = new ConversationController(project, runtime, saved, {
+  const conversationController = isWorkflow ? void 0 : new ConversationController(project, runtime, saved, {
     changed: broadcast,
     log: (message) => process.stderr.write(`${message}
 `),
     save: (sessions, activeId) => {
       const content = JSON.stringify({ sessions, activeId });
       pendingSave = pendingSave.catch(() => void 0).then(async () => {
-        await mkdir(path2.dirname(historyPath), { recursive: true });
+        await mkdir(path3.dirname(historyPath), { recursive: true });
         const temp = `${historyPath}.${process.pid}.tmp`;
         await writeFile(temp, content, { mode: 384 });
         await rename(temp, historyPath);
@@ -1088,6 +1810,51 @@ async function startWebServer(options) {
       return pendingSave;
     }
   });
+  const controller = conversationController;
+  const runsPath = path3.join(storageDir, key, "runs.json");
+  let workspace;
+  if (isWorkflow) {
+    try {
+      workspace = JSON.parse(await readFile2(runsPath, "utf8"));
+      if (workspace?.version !== 1 || !Array.isArray(workspace.runs) || !workspace.drafts || typeof workspace.drafts !== "object") {
+        throw new Error("Invalid Workflow history.");
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        runtime.dispose();
+        throw error;
+      }
+      workspace = migrateWorkflowHistory(saved.sessions ?? [], saved.activeId);
+    }
+  }
+  const workflowController = isWorkflow ? new WorkflowController(project, runtime, workspace, {
+    changed: broadcast,
+    legacy: saved.sessions,
+    log: (message) => process.stderr.write(`${message}
+`),
+    save: (workspace2) => {
+      const content = JSON.stringify(workspace2);
+      pendingSave = pendingSave.catch(() => void 0).then(async () => {
+        await mkdir(path3.dirname(runsPath), { recursive: true });
+        const temp = `${runsPath}.${process.pid}.tmp`;
+        await writeFile(temp, content, { mode: 384 });
+        await rename(temp, runsPath);
+      });
+      return pendingSave;
+    }
+  }) : void 0;
+  const workflowActions = workflowController ? createWorkflowActions(workflowController, runtime, project, () => authRevision, broadcast) : void 0;
+  if (workflowController) {
+    await workflowController.persist();
+  }
+  const stopForAuthentication = async () => {
+    for (const session of conversationController?.sessions ?? []) {
+      conversationController.stop(session);
+    }
+    if (workflowController) {
+      await workflowController.stop("Workflow login changed.");
+    }
+  };
   const refreshAuth = async (force = false) => {
     if ((passwordLogin || login) && !force) {
       return;
@@ -1118,10 +1885,12 @@ ${token}`;
       connection = void 0;
       authRevision++;
       parameterStates.clear();
-      for (const session of controller.sessions) {
-        controller.stop(session);
+      workflowActions?.invalidate();
+      if (authenticationInitialized) {
+        await stopForAuthentication();
       }
     }
+    authenticationInitialized = true;
     account = { status: candidate ? "checking" : "signed-out", serverUrl: serverUrl || "http://localhost:7126", user: candidate ? changed ? hostManaged ? void 0 : config.user : account.user : void 0, revision: account.revision + 1 };
     if (candidate) {
       let unauthorized = false;
@@ -1139,9 +1908,11 @@ ${token}`;
         if (!connection) {
           authRevision++;
           parameterStates.clear();
+          workflowActions?.invalidate();
         }
         connection = candidate;
-        account = { ...account, status: "authenticated", user: profile, expiresAt: result.data.principal?.expiresAt ?? config.expiresAt };
+        const savedConnection = !hostManaged && candidate.serverUrl === config.serverUrl.replace(/\/+$/, "") && candidate.accessToken === config.apiKey;
+        account = { ...account, status: "authenticated", user: profile, expiresAt: result.data.principal?.expiresAt ?? (savedConnection ? config.expiresAt : void 0) };
       } catch (error) {
         if (epoch !== authEpoch) {
           return;
@@ -1150,9 +1921,8 @@ ${token}`;
         if (!changed) {
           authRevision++;
           parameterStates.clear();
-          for (const session of controller.sessions) {
-            controller.stop(session);
-          }
+          workflowActions?.invalidate();
+          await stopForAuthentication();
         }
         account = { ...account, status: unauthorized ? "expired" : "error", error: String(error.message) };
       }
@@ -1214,11 +1984,14 @@ ${token}`;
     if (message.projectUri && message.projectUri !== project.uri) {
       throw new Error("Project changed.");
     }
-    if (message.sessionId && message.sessionId !== controller.activeId) {
+    if (workflowActions && !["ready", "login", "verify", "logout", "usage"].includes(message.type)) {
+      return publicValue(await workflowActions.handle(message));
+    }
+    if (message.sessionId && message.sessionId !== conversationController?.activeId) {
       throw new Error("Conversation changed.");
     }
     const replies = [];
-    const current = controller.current;
+    const current = conversationController?.current;
     const entrypointId = typeof message.entrypointId === "string" && message.entrypointId ? message.entrypointId : project.defaultEntrypoint;
     if (entrypointId && !project.entrypoints.some((entry) => entry.id === entrypointId)) {
       throw new Error("Unknown entrypoint.");
@@ -1379,12 +2152,13 @@ ${token}`;
         if (card.kind === "kv" || card.kind === "knowledge") {
           replies.push({ type: "preview", title: card.title, content: await runtime.readResource(project, current.id, card.kind, card.target) });
         } else if (card.kind === "file") {
-          const filename = await realpath(path2.resolve(projectDir, card.target.filePath));
-          const relative = path2.relative(projectDir, filename);
-          if (relative.startsWith("..") || path2.isAbsolute(relative)) {
+          const root = await realpath2(project.assistant?.workdir ?? projectDir);
+          const filename = await realpath2(path3.resolve(root, card.target.filePath));
+          const relative = path3.relative(root, filename);
+          if (relative === ".." || relative.startsWith(`..${path3.sep}`) || path3.isAbsolute(relative)) {
             throw new Error("File is outside this project.");
           }
-          replies.push({ type: "preview", title: card.title, content: await readFile(filename, "utf8") });
+          replies.push({ type: "preview", title: card.title, content: await readFile2(filename, "utf8") });
         } else {
           throw new Error("This resource requires an editor host.");
         }
@@ -1399,7 +2173,7 @@ ${token}`;
         if (!response.ok || result.errCode !== 0) {
           throw new Error(result.errMessage || "Cannot load usage.");
         }
-        replies.push({ type: "usage", sessionId: current.id, usage: result.data });
+        replies.push({ type: "usage", sessionId: current?.id, usage: result.data });
         break;
       }
       case "login": {
@@ -1441,7 +2215,7 @@ ${token}`;
           await refreshAuth(true);
           break;
         }
-        login = spawn2(process.execPath, [path2.join(cliRoot(), "dist/index.js"), "workspace", "login", "--server", url.toString().replace(/\/$/, "")], { shell: false, stdio: ["ignore", "ignore", "pipe"] });
+        login = spawn2(process.execPath, [path3.join(cliRoot(), "dist/index.js"), "workspace", "login", "--server", url.toString().replace(/\/$/, "")], { shell: false, stdio: ["ignore", "ignore", "pipe"] });
         login.stderr?.on("data", (chunk) => process.stderr.write(chunk));
         login.once("error", (error) => {
           login = void 0;
@@ -1538,7 +2312,7 @@ ${token}`;
         }
         if (url.pathname.startsWith("/api/file/") && request.method === "GET") {
           const file = await runtime.readFile(project, decodeURIComponent(url.pathname.slice("/api/file/".length)));
-          const bytes = await readFile(file.path);
+          const bytes = await readFile2(file.path);
           const safeType = /^(?:image\/(?:png|jpeg|gif|webp|avif)|audio\/[a-z0-9.+-]+|video\/[a-z0-9.+-]+)$/.test(file.reference.mimeType);
           response.writeHead(200, { "Content-Type": safeType ? file.reference.mimeType : "application/octet-stream", "Content-Disposition": `${safeType ? "inline" : "attachment"}; filename*=UTF-8''${encodeURIComponent(file.reference.name)}`, "Cache-Control": "no-store" });
           response.end(bytes);
@@ -1559,15 +2333,18 @@ ${token}`;
       if (url.pathname === "/") {
         const ancestors = options.host ? "'self' vscode-webview: vscode-file: https://*.vscode-cdn.net https://*.vscode-webview.net http://127.0.0.1:* http://localhost:*" : "'self' vscode-webview:";
         response.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", "Content-Security-Policy": `default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https: http:; font-src 'self'; connect-src 'self'; media-src 'self' blob:; object-src 'none'; base-uri 'none'; frame-ancestors ${ancestors}; form-action 'self'` });
-        response.end(`<!doctype html><html lang="zh-CN" data-theme="${options.theme ?? "auto"}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="workflow-project" content="${key}"><title>Workflow</title><link rel="stylesheet" href="/assets/codicons/codicon.css"><link rel="stylesheet" href="/assets/workflow-ui.css"><link rel="stylesheet" href="/assets/theme.css"></head><body data-surface="${options.host?.surface ?? "editor"}"><div id="app"></div><script src="/assets/workflow-ui.js" defer></script></body></html>`);
+        const ui = isWorkflow ? "workflow-workspace" : "workflow-ui";
+        response.end(`<!doctype html><html lang="zh-CN" data-theme="${options.theme ?? "auto"}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="workflow-project" content="${key}"><title>Workflow</title><link rel="stylesheet" href="/assets/codicons/codicon.css"><link rel="stylesheet" href="/assets/${ui}.css"><link rel="stylesheet" href="/assets/theme.css"></head><body data-surface="${options.host?.surface ?? "editor"}"><div id="app"></div><script src="/assets/${ui}.js" defer></script></body></html>`);
         return;
       }
       const assets = { "/assets/workflow-ui.js": "application/javascript", "/assets/workflow-ui.css": "text/css", "/assets/theme.css": "text/css", "/assets/codicons/codicon.css": "text/css", "/assets/codicons/codicon.ttf": "font/ttf" };
+      assets["/assets/workflow-workspace.js"] = "application/javascript";
+      assets["/assets/workflow-workspace.css"] = "text/css";
       if (!assets[url.pathname]) {
         json(response, 404, { message: "Not found." });
         return;
       }
-      const content = await readFile(path2.join(cliRoot(), "dist/web", url.pathname.slice("/assets/".length)));
+      const content = await readFile2(path3.join(cliRoot(), "dist/web", url.pathname.slice("/assets/".length)));
       response.writeHead(200, { "Content-Type": assets[url.pathname], "Cache-Control": "no-cache" });
       response.end(content);
     })().catch((error) => {
@@ -1588,7 +2365,8 @@ ${token}`;
     });
   } catch (error) {
     clearInterval(authPoll);
-    controller.dispose();
+    conversationController?.dispose();
+    workflowController?.dispose();
     runtime.dispose();
     throw error;
   }
@@ -1599,6 +2377,7 @@ ${token}`;
     url: `${origin}/#session=${capability}`,
     project,
     controller,
+    workflowController,
     setHostConnection: async (value) => {
       authEpoch++;
       authCheck?.abort();
@@ -1615,14 +2394,17 @@ ${token}`;
         clearTimeout(broadcastTimer);
       }
       login?.kill();
-      controller.dispose();
+      conversationController?.dispose();
+      workflowController?.dispose();
       runtime.dispose();
       for (const client of clients) {
         client.end();
       }
       await new Promise((resolve) => server.close(() => resolve()));
-      await controller.idle();
-      await controller.persist();
+      await conversationController?.idle();
+      await conversationController?.persist();
+      await workflowController?.idle();
+      await workflowController?.persist();
       await pendingSave;
     })()
   };
@@ -1632,7 +2414,7 @@ ${token}`;
 import { createInterface } from "readline";
 
 // src/web/host-config.ts
-import path3 from "path";
+import path4 from "path";
 function parseHostConnection(value) {
   if (value === null || value === void 0) {
     return;
@@ -1656,10 +2438,17 @@ function parseHostConfiguration(value) {
     throw new Error("Invalid web host configuration.");
   }
   const assistant = configuration.assistant;
-  if (assistant && (typeof assistant.workdir !== "string" || !path3.isAbsolute(assistant.workdir) || !Array.isArray(assistant.roots) || !assistant.roots.length || assistant.roots.length > 100 || assistant.roots.some((root) => typeof root.uri !== "string" || typeof root.name !== "string" || typeof root.folderPath !== "string" || !path3.isAbsolute(root.folderPath)) || !assistant.roots.some((root) => root.folderPath === assistant.workdir))) {
+  if (assistant && (typeof assistant.workdir !== "string" || !path4.isAbsolute(assistant.workdir) || !Array.isArray(assistant.roots) || !assistant.roots.length || assistant.roots.length > 100 || assistant.standalone !== void 0 && typeof assistant.standalone !== "boolean" || assistant.roots.some((root) => typeof root.uri !== "string" || typeof root.name !== "string" || typeof root.folderPath !== "string" || !path4.isAbsolute(root.folderPath)) || !assistant.roots.some((root) => root.folderPath === assistant.workdir))) {
     throw new Error("Invalid assistant workspace.");
   }
-  return { surface: configuration.surface, assistant, connection: parseHostConnection(configuration.connection) };
+  const assistantProjectDir = configuration.assistantProjectDir;
+  if (configuration.surface === "assistant" && (!assistant || typeof assistantProjectDir !== "string" || !path4.isAbsolute(assistantProjectDir))) {
+    throw new Error("A dedicated assistant project and its workspace are required.");
+  }
+  if (configuration.surface !== "assistant" && (assistant || assistantProjectDir !== void 0)) {
+    throw new Error("Assistant configuration requires the assistant surface.");
+  }
+  return { surface: configuration.surface, assistant, assistantProjectDir, connection: parseHostConnection(configuration.connection) };
 }
 
 // src/web.ts
@@ -1694,12 +2483,12 @@ function parseWebArgs(argv) {
         }
         options.theme = value;
       } else {
-        options.dataDir = path4.resolve(value);
+        options.dataDir = path5.resolve(value);
       }
     } else if (arg.startsWith("-") || projectSet) {
       throw new Error(`Unknown web argument: ${arg}`);
     } else {
-      options.projectDir = path4.resolve(arg);
+      options.projectDir = path5.resolve(arg);
       projectSet = true;
     }
   }
@@ -1711,15 +2500,6 @@ async function main(argv) {
     console.log(i18n.language.startsWith("zh") ? "workflow-code web [\u9879\u76EE\u76EE\u5F55]\n  --port <0-65535>   \u76D1\u542C\u7AEF\u53E3\uFF0C0 \u81EA\u52A8\u5206\u914D\n  --no-open          \u4E0D\u81EA\u52A8\u6253\u5F00\u6D4F\u89C8\u5668\n  --theme <auto|light|dark>\n  --data-dir <\u76EE\u5F55>   \u5BF9\u8BDD\u548C\u6587\u4EF6\u5B58\u50A8\u4F4D\u7F6E\n  --json             \u8F93\u51FA\u7ED3\u6784\u5316\u542F\u52A8\u4FE1\u606F" : "workflow-code web [project-directory]\n  --port <0-65535>   Listen port; 0 selects an available port\n  --no-open          Do not open a browser\n  --theme <auto|light|dark>\n  --data-dir <path>   Conversation and file storage directory\n  --json             Print structured startup information");
     return 0;
   }
-  if (options.inspect) {
-    const runtime = createWebRuntime(options.projectDir, options.dataDir ?? "", () => void 0);
-    try {
-      console.log(JSON.stringify(await runtime.inspect([options.projectDir])));
-    } finally {
-      runtime.dispose();
-    }
-    return 0;
-  }
   const input = options.hostStdio ? createInterface({ input: process.stdin, crlfDelay: Infinity }) : void 0;
   const lines = input?.[Symbol.asyncIterator]();
   let host;
@@ -1735,6 +2515,17 @@ async function main(argv) {
     input?.close();
     throw error;
   }
+  if (options.inspect) {
+    const runtime = createWebRuntime(options.projectDir, options.dataDir ?? "", () => void 0);
+    try {
+      console.log(JSON.stringify(await inspectWebProject(runtime, options.projectDir, host)));
+    } finally {
+      runtime.dispose();
+      input?.close();
+      process.stdin.pause();
+    }
+    return 0;
+  }
   const app = await startWebServer({ ...options, host }).catch((error) => {
     input?.close();
     throw error;
@@ -1751,7 +2542,7 @@ async function main(argv) {
   };
   process.once("SIGINT", close);
   process.once("SIGTERM", close);
-  console.log(options.json ? JSON.stringify({ type: "ready", protocolVersion: 1, hostProtocolVersion: 1, url: app.url, project: { id: app.project.id, name: app.project.name, projectType: app.project.projectType }, runtime: app.project.runtime }) : `Workflow Web: ${app.url}`);
+  console.log(options.json ? JSON.stringify({ type: "ready", protocolVersion: 1, hostProtocolVersion: 1, assistantProtocolVersion: host?.assistant ? ASSISTANT_PROTOCOL_VERSION : void 0, url: app.url, project: { id: app.project.id, name: app.project.name, projectType: app.project.projectType }, runtime: app.project.runtime }) : `Workflow Web: ${app.url}`);
   if (lines) {
     void (async () => {
       try {