jsfe 0.8.0 → 0.9.1

package/dist/index.js

@@ -302,6 +302,66 @@ export function getFlowPrompt(engine, flowName) {
     // Fallback to default prompt or flow name
     return flow.prompt || flow.name;
 }
+// Pure function-based transaction management (no methods, always serializable)
+export class TransactionManager {
+    static create(flowName, initiator, userId) {
+        return {
+            id: crypto.randomUUID(),
+            flowName: flowName,
+            initiator: initiator,
+            userId: userId,
+            steps: [],
+            state: 'active',
+            createdAt: new Date(),
+            metadata: {}
+        };
+    }
+    static addStep(transaction, step, result, duration, status = 'success') {
+        const transactionStep = {
+            stepId: step.id || crypto.randomUUID(),
+            stepType: step.type || 'unknown',
+            timestamp: new Date(),
+            duration: duration,
+            status: status,
+            result: TransactionManager.sanitizeForLog(result)
+        };
+        if (status === 'error' && result instanceof Error) {
+            transactionStep.error = result.message;
+        }
+        transaction.steps.push(transactionStep);
+    }
+    static addError(transaction, step, error, duration) {
+        TransactionManager.addStep(transaction, step, error, duration, 'error');
+    }
+    static sanitizeForLog(data) {
+        if (typeof data === 'string') {
+            return data.length > 500 ? data.substring(0, 500) + '...' : data;
+        }
+        if (typeof data === 'object' && data !== null) {
+            try {
+                const jsonStr = JSON.stringify(data);
+                return jsonStr.length > 500 ? jsonStr.substring(0, 500) + '...' : data;
+            }
+            catch {
+                return '[Circular or non-serializable object]';
+            }
+        }
+        return data;
+    }
+    static rollback(transaction) {
+        transaction.state = 'rolled_back';
+        transaction.rolledBackAt = new Date();
+    }
+    static complete(transaction) {
+        transaction.state = 'completed';
+        transaction.completedAt = new Date();
+    }
+    static fail(transaction, reason) {
+        transaction.state = 'failed';
+        transaction.failedAt = new Date();
+        transaction.failureReason = reason;
+    }
+}
 // Initialize JSON Schema validator
 const ajv = new Ajv({ allErrors: true, strict: false });
 addFormats(ajv);
@@ -318,6 +378,7 @@ function isPathTraversableObject(val) {
  * @param data - Source data to transform (typically API response)
  * @param mappingConfig - Mapping configuration specifying how to transform the data
  * @param args - Arguments available for template variables and $args references
+ * @param engine - Engine instance for context and utilities
  * @returns Transformed data according to mapping configuration
  *
  * @example
@@ -335,7 +396,7 @@ function isPathTraversableObject(val) {
  * ) // "Name: Alice, Age: 25"
  * ```
  */
-function applyResponseMapping(data, mappingConfig, args = {}) {
+function applyResponseMapping(data, mappingConfig, args = {}, engine) {
     logger.debug(`applyResponseMapping called with: dataType=${typeof data}, data=${JSON.stringify(data)}, mappingConfig=${JSON.stringify(mappingConfig)}, args=${JSON.stringify(args)}`);
     if (!mappingConfig) {
         logger.debug(`No mapping config provided, returning original data`);
@@ -355,13 +416,13 @@ function applyResponseMapping(data, mappingConfig, args = {}) {
             case 'jsonPath':
                 return applyJsonPathMapping(data, mappingConfig, args);
             case 'object':
-                return applyObjectMapping(data, mappingConfig, args);
+                return applyObjectMapping(data, mappingConfig, args, engine);
             case 'array':
-                return applyArrayMapping(data, mappingConfig, args);
+                return applyArrayMapping(data, mappingConfig, args, engine);
             case 'template':
-                return applyTemplateMapping(data, mappingConfig, args);
+                return applyTemplateMapping(data, mappingConfig, args, engine);
             case 'conditional':
-                return applyConditionalMapping(data, mappingConfig, args);
+                return applyConditionalMapping(data, mappingConfig, args, engine);
         }
     }
     // Handle PathConfig (has path property but not type)
@@ -468,7 +529,7 @@ function applyJsonPathMapping(data, config, args) {
     return result;
 }
 // Object structure mapping with nested transformations
-function applyObjectMapping(data, config, args) {
+function applyObjectMapping(data, config, args, engine) {
     const result = {};
     for (const [key, value] of Object.entries(config.mappings)) {
         try {
@@ -478,7 +539,7 @@ function applyObjectMapping(data, config, args) {
             }
             else if (typeof value === 'object' && value !== null && 'type' in value) {
                 // Nested mapping with type
-                result[key] = applyResponseMapping(data, value, args);
+                result[key] = applyResponseMapping(data, value, args, engine);
             }
             else if (typeof value === 'object' && value !== null && 'path' in value) {
                 // Object with path and optional transform
@@ -496,7 +557,7 @@ function applyObjectMapping(data, config, args) {
             }
             else if (typeof value === 'object' && value !== null) {
                 // Static object with potential interpolation
-                result[key] = interpolateObject(value, data, args);
+                result[key] = interpolateObject(value, data, args, engine);
             }
             else {
                 // Literal value
@@ -517,7 +578,7 @@ function applyObjectMapping(data, config, args) {
     return result;
 }
 // Array transformation and filtering
-function applyArrayMapping(data, config, args) {
+function applyArrayMapping(data, config, args, engine) {
     const sourceArray = config.source ? extractByPath(data, config.source) : data;
     if (!Array.isArray(sourceArray)) {
         logger.warn(`Array mapping source is not an array:`, sourceArray);
@@ -541,7 +602,7 @@ function applyArrayMapping(data, config, args) {
     if (config.itemMapping) {
         result = result.map((item, index) => {
             try {
-                return applyResponseMapping(item, config.itemMapping, { ...args, index });
+                return applyResponseMapping(item, config.itemMapping, { ...args, index }, engine);
             }
             catch (error) {
                 const errorMessage = error instanceof Error ? error.message : 'Unknown error';
@@ -584,7 +645,7 @@ function applyArrayMapping(data, config, args) {
     return result;
 }
 // Template-based string interpolation
-function applyTemplateMapping(data, config, args) {
+function applyTemplateMapping(data, config, args, engine) {
     let template = config.template;
     // Check if template contains complex Handlebars syntax
     const hasHandlebarsIteration = /\{\{#each\s+[^}]+\}\}/.test(template);
@@ -606,7 +667,7 @@ function applyTemplateMapping(data, config, args) {
     return template;
 }
 // Conditional mapping based on data content
-function applyConditionalMapping(data, config, args) {
+function applyConditionalMapping(data, config, args, engine) {
     if (!config.conditions || !Array.isArray(config.conditions)) {
         throw new Error('Conditional mapping requires a conditions array');
     }
@@ -625,7 +686,7 @@ function applyConditionalMapping(data, config, args) {
                 conditionResult = evaluateCondition(data, condition.if);
             }
             if (conditionResult) {
-                return applyResponseMapping(data, condition.then, args);
+                return applyResponseMapping(data, condition.then, args, engine);
             }
         }
         catch (error) {
@@ -636,7 +697,7 @@ function applyConditionalMapping(data, config, args) {
     }
     // Default case
     if (config.else) {
-        return applyResponseMapping(data, config.else, args);
+        return applyResponseMapping(data, config.else, args, engine);
     }
     return data;
 }
@@ -1153,6 +1214,7 @@ function evaluateCondition(data, condition) {
     if (!condition || typeof condition !== 'object')
         return false;
     const { field, operator, value } = condition;
+    logger.debug(`evaluateCondition called with field: ${field}, operator: ${operator}, value: ${value}`);
     try {
         let fieldValue = undefined;
         if (isPathTraversableObject(data)) {
@@ -1161,44 +1223,61 @@ function evaluateCondition(data, condition) {
         switch (operator) {
             case 'equals':
             case 'eq':
+                logger.debug(`evaluateCondition: checking equality for field ${field} with value ${value}`);
                 return fieldValue === value;
             case 'notEquals':
             case 'ne':
+                logger.debug(`evaluateCondition: checking inequality for field ${field} with value ${value}`);
                 return fieldValue !== value;
             case 'contains':
+                logger.debug(`evaluateCondition: checking containment for field ${field} with value ${value}`);
                 return String(fieldValue).includes(String(value));
             case 'exists':
+                logger.debug(`evaluateCondition: checking existence for field ${field}`);
                 return fieldValue !== null && fieldValue !== undefined;
             case 'notExists':
+                logger.debug(`evaluateCondition: checking non-existence for field ${field}`);
                 return fieldValue === null || fieldValue === undefined;
             case 'greaterThan':
             case 'gt':
+                logger.debug(`evaluateCondition: checking greaterThan for field ${field} with value ${value}`);
                 return Number(fieldValue) > Number(value);
             case 'lessThan':
             case 'lt':
+                logger.debug(`evaluateCondition: checking lessThan for field ${field} with value ${value}`);
                 return Number(fieldValue) < Number(value);
             case 'greaterThanOrEqual':
             case 'gte':
+                logger.debug(`evaluateCondition: checking greaterThanOrEqual for field ${field} with value ${value}`);
                 return Number(fieldValue) >= Number(value);
             case 'lessThanOrEqual':
             case 'lte':
+                logger.debug(`evaluateCondition: checking lessThanOrEqual for field ${field} with value ${value}`);
                 return Number(fieldValue) <= Number(value);
             case 'startsWith':
+                logger.debug(`evaluateCondition: checking startsWith for field ${field} with value ${value}`);
                 return String(fieldValue).startsWith(String(value));
             case 'endsWith':
+                logger.debug(`evaluateCondition: checking endsWith for field ${field} with value ${value}`);
                 return String(fieldValue).endsWith(String(value));
             case 'matches':
+                logger.debug(`evaluateCondition: checking regex match for field ${field} with value ${value}`);
                 return new RegExp(String(value)).test(String(fieldValue));
             case 'in':
+                logger.debug(`evaluateCondition: checking inclusion for field ${field} with value ${value}`);
                 return Array.isArray(value) && value.includes(fieldValue);
             case 'hasLength':
                 const length = Array.isArray(fieldValue) ? fieldValue.length : String(fieldValue).length;
+                logger.debug(`evaluateCondition: checking length for field ${field} with value ${value}, actual length: ${length}`);
                 return length === Number(value);
             case 'isArray':
+                logger.debug(`evaluateCondition: checking if field ${field} is an array`);
                 return Array.isArray(fieldValue);
             case 'isObject':
+                logger.debug(`evaluateCondition: checking if field ${field} is an object`);
                 return typeof fieldValue === 'object' && fieldValue !== null && !Array.isArray(fieldValue);
             case 'isString':
+                logger.debug(`evaluateCondition: checking if field ${field} is a string`);
                 return typeof fieldValue === 'string';
             case 'isNumber':
                 return typeof fieldValue === 'number' && !isNaN(fieldValue);
@@ -1212,14 +1291,58 @@ function evaluateCondition(data, condition) {
         return false;
     }
 }
-function interpolateObject(obj, data, args = {}) {
+function interpolateObject(obj, data, args = {}, engine) {
     if (typeof obj === 'string') {
-        // Handle template strings
+        // Check if the string is ONLY a single template expression (e.g., '{{cargo}}')
+        const singleTemplateMatch = obj.match(/^\{\{([^}]+)\}\}$/);
+        if (singleTemplateMatch) {
+            // This is a single template expression - return the actual value, not a string conversion
+            const path = singleTemplateMatch[1].trim();
+            try {
+                let value = undefined;
+                if (isPathTraversableObject(data)) {
+                    value = extractByPath(data, path);
+                    // Handle user input wrapper objects
+                    if (isUserInputVariable(value)) {
+                        value = value.value;
+                    }
+                }
+                // If not found in data and engine is available, use the new unified resolver
+                if ((value === undefined || value === null)) {
+                    try {
+                        // Use the new resolveVariablePath function which handles all variable types
+                        value = resolveVariablePath(path, args, [], engine);
+                    }
+                    catch (error) {
+                        // Ignore variable resolution errors
+                    }
+                }
+                return value !== undefined && value !== null ? value : '';
+            }
+            catch (error) {
+                return obj; // Keep original on error
+            }
+        }
+        // Handle template strings with multiple expressions or mixed content
         return obj.replace(/\{\{([^}]+)\}\}/g, (match, path) => {
             try {
                 let value = undefined;
                 if (isPathTraversableObject(data)) {
                     value = extractByPath(data, path.trim());
+                    // Handle user input wrapper objects
+                    if (isUserInputVariable(value)) {
+                        value = value.value;
+                    }
+                }
+                // If not found in data and engine is available, use the new unified resolver
+                if ((value === undefined || value === null)) {
+                    try {
+                        // Use the new resolveVariablePath function which handles all variable types
+                        value = resolveVariablePath(path.trim(), args, [], engine);
+                    }
+                    catch (error) {
+                        // Ignore variable resolution errors
+                    }
                 }
                 return value !== null && value !== undefined ? String(value) : '';
             }
@@ -1237,24 +1360,34 @@ function interpolateObject(obj, data, args = {}) {
         });
     }
     else if (Array.isArray(obj)) {
-        return obj.map(item => interpolateObject(item, data, args));
+        return obj.map(item => interpolateObject(item, data, args, engine));
     }
     else if (typeof obj === 'object' && obj !== null) {
         const result = {};
         for (const [key, value] of Object.entries(obj)) {
-            result[key] = interpolateObject(value, data, args);
+            result[key] = interpolateObject(value, data, args, engine);
         }
         return result;
     }
     return obj;
 }
-// Fake logger that does nothing - in case hostLogger argument to engine.initSession is null
-let logger = {
-    info: () => { },
-    warn: () => { },
-    error: () => { },
-    debug: () => { }
-};
+function makeLogger(level = process.env.LOG_LEVEL || "warn") {
+    const ORDER = { debug: 10, info: 20, warn: 30, error: 40 };
+    let current = ORDER[level] ?? ORDER.warn;
+    const allow = (lvl) => ORDER[lvl] >= current;
+    return {
+        setLevel: (lvl) => { current = ORDER[lvl] ?? current; },
+        debug: (...a) => { if (allow("debug"))
+            console.debug(...a); },
+        info: (...a) => { if (allow("info"))
+            console.info(...a); },
+        warn: (...a) => { if (allow("warn"))
+            console.warn(...a); },
+        error: (...a) => { if (allow("error"))
+            console.error(...a); },
+    };
+}
+let logger = makeLogger();
 // Fallback for any remaining console calls
 if (!global.console) {
     global.console = {
@@ -1264,73 +1397,6 @@ if (!global.console) {
         info: (...args) => logger.info(args.join(' '))
     };
 }
-// === TRANSACTION MANAGEMENT CLASS ===
-class FlowTransaction {
-    constructor(flowName, initiator, userId = 'anonymous') {
-        this.steps = [];
-        this.state = 'active';
-        this.metadata = {};
-        this.id = crypto.randomUUID();
-        this.flowName = flowName;
-        this.initiator = initiator;
-        this.userId = userId;
-        this.steps = [];
-        this.state = 'active';
-        this.createdAt = new Date();
-        this.metadata = {};
-    }
-    addStep(step, result, duration, status = 'success') {
-        this.steps.push({
-            stepId: step.id || step.type,
-            stepType: step.type,
-            tool: step.tool,
-            result: this.sanitizeForLog(result),
-            duration,
-            status,
-            timestamp: new Date(),
-            retryCount: step.retryCount || 0
-        });
-    }
-    addError(step, error, duration) {
-        this.steps.push({
-            stepId: step.id || step.type,
-            stepType: step.type,
-            tool: step.tool,
-            error: error.message,
-            duration,
-            status: 'error',
-            timestamp: new Date()
-        });
-    }
-    sanitizeForLog(data) {
-        if (typeof data === 'object' && data !== null) {
-            const sanitized = { ...data };
-            // Remove sensitive fields
-            delete sanitized.signature;
-            delete sanitized.password;
-            delete sanitized.token;
-            return sanitized;
-        }
-        return data;
-    }
-    rollback() {
-        // In a real implementation, this would execute compensating actions
-        this.state = 'rolled_back';
-        this.rolledBackAt = new Date();
-        auditLogger.logTransactionRollback(this);
-    }
-    complete() {
-        this.state = 'completed';
-        this.completedAt = new Date();
-        auditLogger.logTransactionComplete(this);
-    }
-    fail(reason) {
-        this.state = 'failed';
-        this.failedAt = new Date();
-        this.failureReason = reason;
-        auditLogger.logTransactionFailed(this);
-    }
-}
 // === COMPREHENSIVE AUDIT LOGGING ===
 const auditLogger = {
     logFlowStart(flowName, input, userId, transactionId) {
@@ -1463,11 +1529,8 @@ function checkRateLimit(engine, userId, toolId) {
 function sanitizeInput(input) {
     if (typeof input !== 'string')
         return input;
-    // Basic HTML escape and trim
-    return input.trim().replace(/[<>'"&]/g, (char) => {
-        const escapeMap = { '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#x27;', '&': '&amp;' };
-        return escapeMap[char];
-    });
+    // Simple trim - no HTML encoding since user input is treated as literal data
+    return input.trim();
 }
 function validateToolArgs(tool, args) {
     if (!tool.parameters)
@@ -1616,7 +1679,8 @@ function exportConversationHistory(contextStack, format = 'simple') {
 // Stored in engine.flowStacks for proper context isolation
 function initializeFlowStacks(engine) {
     try {
-        engine.flowStacks = [[]];
+        // Use the engine method directly since Engine is now an alias for WorkflowEngine
+        engine.initializeFlowStacks();
     }
     catch (error) {
         logger.error("Failed to initialize flow stacks:", error.message);
@@ -1631,7 +1695,11 @@ function pushToCurrentStack(engine, flowFrame) {
     getCurrentStack(engine).push(flowFrame);
 }
 function popFromCurrentStack(engine) {
-    return getCurrentStack(engine).pop();
+    const result = getCurrentStack(engine).pop();
+    if (!result) {
+        throw new Error('Cannot pop from empty stack');
+    }
+    return result;
 }
 function createNewStack(engine) {
     // Create new stack and switch to it
@@ -1703,7 +1771,7 @@ async function isFlowActivated(input, engine, userId = 'anonymous') {
     const flowsMenu = engine.flowsMenu;
     const flow = await getFlowForInput(input, engine);
     if (flow) {
-        const transaction = new FlowTransaction(flow.name, 'user-input', userId);
+        const transaction = TransactionManager.create(flow.name, 'user-input', userId);
         // Prepare tentative flow_init message that will be replaced by SAY-GET guidance if present
         const tentativeFlowInit = getSystemMessage(engine, 'flow_init', {
             flowName: flow.name,
@@ -1741,7 +1809,7 @@ async function playFlowFrame(engine) {
             auditLogger.logFlowExit(currentFlowFrame.flowName, currentFlowFrame.userId, currentFlowFrame.transaction.id, 'max_recursion_depth');
             // Do we need this?
             //currentFlowFrame.contextStack.push(error.message);
-            currentFlowFrame.transaction.fail("Max recursion depth exceeded");
+            TransactionManager.fail(currentFlowFrame.transaction, "Max recursion depth exceeded");
         }
         throw error;
     }
@@ -1764,10 +1832,11 @@ async function playFlowFrame(engine) {
                 delete currentFlowFrame.pendingVariable;
             }
             else {
-                // Store user input as variable value
+                // Store user input as variable value with proper sanitization
                 // (System commands like 'cancel' are already handled before this point)
-                currentFlowFrame.variables[currentFlowFrame.pendingVariable] = userInput;
-                logger.info(`Stored user input in variable '${currentFlowFrame.pendingVariable}': "${userInput}"`);
+                setUserInputVariable(currentFlowFrame.variables, currentFlowFrame.pendingVariable, userInput, true // Sanitize user input
+                );
+                logger.info(`Stored sanitized user input in variable '${currentFlowFrame.pendingVariable}': "${userInput}"`);
                 delete currentFlowFrame.pendingVariable;
                 // Pop the SAY-GET step now that variable assignment is complete
                 currentFlowFrame.flowStepsStack.pop();
@@ -1778,7 +1847,7 @@ async function playFlowFrame(engine) {
         if (currentFlowFrame.flowStepsStack.length === 0) {
             logger.info(`Flow ${currentFlowFrame.flowName} completed, popping from stack (steps length: ${currentFlowFrame.flowStepsStack.length})`);
             const completedFlow = popFromCurrentStack(engine);
-            completedFlow.transaction.complete();
+            TransactionManager.complete(completedFlow.transaction);
             // When a flow completes, it doesn't "return" a value in the traditional sense.
             // It communicates results by setting variables in the shared `variables` object,
             // which are then accessible to the parent flow.
@@ -1832,6 +1901,9 @@ async function playFlowFrame(engine) {
                         }
                         continue;
                     }
+                    else {
+                        logger.error(`Failed to resume flow - no flow frames available after switching stacks.`);
+                    }
                 }
                 else {
                     logger.info(`No more flow frames to process, all flows completed.`);
@@ -1846,7 +1918,7 @@ async function playFlowFrame(engine) {
         try {
             const result = await playStep(currentFlowFrame, engine);
             const duration = Date.now() - startTime;
-            currentFlowFrame.transaction.addStep(step, result, duration, 'success');
+            TransactionManager.addStep(currentFlowFrame.transaction, step, result, duration, 'success');
             logger.info(`Step ${step.type} executed successfully, result: ${typeof result === 'object' ? '[object]' : result}`);
             // If this was a SAY-GET step, return and wait for user input
             if (step.type === 'SAY-GET') {
@@ -1854,7 +1926,7 @@ async function playFlowFrame(engine) {
                 if (currentFlowFrame.flowStepsStack.length === 0) {
                     logger.info(`SAY-GET step was final step, flow ${currentFlowFrame.flowName} completed`);
                     const completedFlow = popFromCurrentStack(engine);
-                    completedFlow.transaction.complete();
+                    TransactionManager.complete(completedFlow.transaction);
                     return result;
                 }
                 return result;
@@ -1864,7 +1936,7 @@ async function playFlowFrame(engine) {
         }
         catch (error) {
             const duration = Date.now() - startTime;
-            currentFlowFrame.transaction.addError(step, error, duration);
+            TransactionManager.addError(currentFlowFrame.transaction, step, error, duration);
             logger.error(`Step ${step.type} failed: ${error.message}`);
             logger.info(`Stack trace: ${error.stack}`);
             throw error;
@@ -2078,7 +2150,7 @@ async function getFlowForInput(input, engine) {
 // === SMART DEFAULT ONFAIL GENERATOR ===
 function generateSmartRetryDefaultOnFail(step, error, currentFlowFrame) {
     const toolName = step.tool || 'unknown';
-    const errorMessage = error.message || 'Unknown error';
+    const errorMessage = error.message.toLocaleLowerCase() || 'unknown error';
     const flowName = currentFlowFrame.flowName;
     logger.info(`Generating smart default onFail for tool ${toolName}, in flow ${flowName} for error: ${errorMessage}`);
     // Categorize error types for intelligent handling
@@ -2106,7 +2178,8 @@ function generateSmartRetryDefaultOnFail(step, error, currentFlowFrame) {
         errorMessage.includes('bad request') ||
         errorMessage.includes('invalid request') ||
         errorMessage.includes('malformed request') ||
-        errorMessage.includes('syntax error');
+        errorMessage.includes('syntax error') ||
+        errorMessage.includes('rate limit');
     // Provoke cancelation of the current flow if unrecoverable
     const isAuthError = errorMessage.includes('401') || // Unauthorized
         errorMessage.includes('402') || // Payment Required
@@ -2132,7 +2205,7 @@ function generateSmartRetryDefaultOnFail(step, error, currentFlowFrame) {
         doCancel = true;
     }
     else {
-        logger.warn(`Unrecognized error type for tool ${toolName} in flow ${flowName}: ${errorMessage}`);
+        logger.debug(`Unrecognized error type for tool ${toolName} in flow ${flowName}: ${errorMessage}`);
         // Default to Cancel for unexpected errors
         doCancel = true;
     }
@@ -2258,7 +2331,7 @@ async function performStepInputValidation(step, currentFlowFrame, engine) {
     // Custom validation function
     if (step.inputValidation.customValidator && engine.APPROVED_FUNCTIONS) {
         try {
-            const validator = engine.APPROVED_FUNCTIONS.get(step.inputValidation.customValidator);
+            const validator = engine.APPROVED_FUNCTIONS[step.inputValidation.customValidator];
             if (typeof validator === 'function') {
                 const customResult = await validator(currentFlowFrame.variables, currentFlowFrame);
                 if (customResult && typeof customResult === 'object') {
@@ -2494,18 +2567,29 @@ async function handleToolStep(currentFlowFrame, engine) {
             const onFailStep = Array.isArray(effectiveOnFail) ? effectiveOnFail[0] : effectiveOnFail;
             const callType = onFailStep.callType || "replace"; // Default to current behavior
             if (callType === "reboot") {
-                // Clear all flows and start fresh with the onFail flow
-                logger.info(`Rebooting with flow: ${onFailStep.name || onFailStep.type}`);
-                // Clean up all existing flows
-                while (getCurrentStackLength(engine) > 0) {
-                    const flow = popFromCurrentStack(engine);
-                    flow.transaction.fail(`Rebooted due to critical failure in ${step.tool}`);
+                // Clear ALL flows across ALL stacks and start completely fresh with the onFail flow
+                logger.info(`Rebooted due to 'reboot' type of onFail step: ${onFailStep.name} in flow ${currentFlowFrame.flowName} for tool ${step.tool}`);
+                // Clean up ALL existing flows across ALL stacks (using proven user exit pattern)
+                const exitedFlows = [];
+                while (engine.flowStacks.length > 0) {
+                    const poppedStack = engine.flowStacks.pop();
+                    if (!poppedStack || poppedStack.length === 0) {
+                        continue;
+                    }
+                    // Process all flows in this stack
+                    for (const flow of poppedStack) {
+                        TransactionManager.fail(flow.transaction, `Rebooted due to 'reboot' type of onFail step: ${onFailStep.name} in flow ${flow?.flowName} for tool ${step.tool}`);
+                        exitedFlows.push(flow.flowName);
+                        auditLogger.logFlowExit(flow.flowName, currentFlowFrame.userId, flow.transaction.id, 'onFail_reboot');
+                    }
                 }
+                // Initialize completely fresh stack system (using proven pattern)
+                initializeFlowStacks(engine);
                 // Start the onFail flow as a new root flow
                 if (onFailStep.type === "FLOW") {
                     const rebootFlow = flowsMenu?.find(f => f.name === onFailStep.name);
                     if (rebootFlow) {
-                        const transaction = new FlowTransaction(rebootFlow.name, 'reboot-recovery', currentFlowFrame.userId);
+                        const transaction = TransactionManager.create(rebootFlow.name, 'reboot-recovery', currentFlowFrame.userId);
                         pushToCurrentStack(engine, {
                             flowName: rebootFlow.name,
                             flowId: rebootFlow.id,
@@ -2525,7 +2609,8 @@ async function handleToolStep(currentFlowFrame, engine) {
                     // Handle non-FLOW onFail steps in reboot mode
                     currentFlowFrame.flowStepsStack = [onFailStep];
                 }
-                return `System rebooted due to critical failure in ${step.tool}`;
+                logger.info(`System completely rebooted due to onFail step for tool ${step.tool}. Exited flows: ${exitedFlows.join(', ')}`);
+                return `System rebooted due to onFail step for tool ${step.tool}. Starting recovery flow ${onFailStep.name}`;
             }
             else if (callType === "replace") {
                 // Current behavior - replace remaining steps in current flow
@@ -2543,7 +2628,7 @@ async function handleToolStep(currentFlowFrame, engine) {
                     // Push onFail flow as sub-flow
                     const onFailFlow = flowsMenu?.find(f => f.name === onFailStep.name);
                     if (onFailFlow) {
-                        const transaction = new FlowTransaction(onFailFlow.name, 'onFail-recovery', currentFlowFrame.userId);
+                        const transaction = TransactionManager.create(onFailFlow.name, 'onFail-recovery', currentFlowFrame.userId);
                         pushToCurrentStack(engine, {
                             flowName: onFailFlow.name,
                             flowId: onFailFlow.id,
@@ -2764,8 +2849,13 @@ function handleSetStep(currentFlowFrame, engine) {
         throw new Error(`SET step requires both 'variable' and 'value' attributes`);
     }
     // Support interpolation in SET values
+    // Use JavaScript evaluation context for security - strings will be properly quoted
     const interpolatedValue = typeof step.value === 'string'
-        ? interpolateMessage(step.value, [], currentFlowFrame?.variables, engine)
+        ? evaluateExpression(step.value, currentFlowFrame?.variables || {}, [], {
+            securityLevel: 'basic',
+            context: 'javascript-evaluation', // Force JavaScript context for SET values
+            returnType: 'auto'
+        }, engine)
         : step.value;
     if (currentFlowFrame && currentFlowFrame.variables !== undefined) {
         currentFlowFrame.variables[step.variable] = interpolatedValue;
@@ -2780,17 +2870,21 @@ async function handleSwitchStep(currentFlowFrame, engine) {
         throw new Error(`SWITCH step requires both 'variable' and 'branches' attributes`);
     }
     // Get the variable value to switch on
-    const switchValue = currentFlowFrame.variables ? currentFlowFrame.variables[step.variable] : undefined;
+    let switchValue = currentFlowFrame.variables ? currentFlowFrame.variables[step.variable] : undefined;
+    // Handle user input wrapper objects
+    if (isUserInputVariable(switchValue)) {
+        switchValue = switchValue.value;
+    }
     logger.info(`SWITCH step: evaluating variable '${step.variable}' with value '${switchValue}'`);
     // Find the matching branch (exact value matching only)
     let selectedStep = null;
     let selectedBranch = null;
-    // SWITCH now only supports exact value matching for optimal performance
+    // SWITCH now supports exact value matching for strings, booleans, and numbers
     // For conditional logic, use the CASE step instead
-    if (switchValue !== undefined && typeof switchValue === 'string' && step.branches[switchValue]) {
-        selectedStep = step.branches[switchValue];
+    if (switchValue !== undefined && step.branches[String(switchValue)]) {
+        selectedStep = step.branches[String(switchValue)];
         selectedBranch = String(switchValue);
-        logger.info(`SWITCH: selected exact match branch '${switchValue}'`);
+        logger.info(`SWITCH: selected exact match branch '${switchValue}' (converted to string key '${String(switchValue)}')`);
     }
     // If no exact match found, use default
     if (!selectedStep && step.branches.default) {
@@ -2880,26 +2974,33 @@ async function handleSubFlowStep(currentFlowFrame, engine) {
         const input = currentFlowFrame.inputStack[currentFlowFrame.inputStack.length - 1];
         const flowsMenu = engine.flowsMenu; // Access the global flows menu
         const subFlowName = step.value || step.name || step.nextFlow;
-        const subFlow = flowsMenu?.find(f => f.name === subFlowName);
+        const subFlow = flowsMenu?.find(f => f.name === subFlowName || f.id === subFlowName);
         if (!subFlow) {
             return getSystemMessage(engine, 'subflow_not_found', { subFlowName });
         }
         const callType = step.callType || "call"; // Default to normal sub-flow call
         logger.info(`Starting sub-flow ${subFlow.name} with callType: ${callType}, input: ${input}`);
         if (callType === "reboot") {
-            // Clear all flows and start fresh
-            logger.info(`Rebooting with flow: ${subFlow.name}`);
-            // Clean up all existing flows
-            while (getCurrentStackLength(engine) > 0) {
-                const flow = popFromCurrentStack(engine);
-                flow.transaction.fail(`Rebooted to flow ${subFlow.name}`);
-            }
-            // Reset to empty stacks
-            // flowStacks = [[]];
-            // We must keep same reference to allow proper stack switching
+            // Clear ALL flows across ALL stacks and start completely fresh
+            logger.info(`Rebooting system with flow: ${subFlow.name}`);
+            // Clean up ALL existing flows across ALL stacks (using proven user exit pattern)
+            const exitedFlows = [];
+            while (engine.flowStacks.length > 0) {
+                const poppedStack = engine.flowStacks.pop();
+                if (!poppedStack || poppedStack.length === 0) {
+                    continue;
+                }
+                // Process all flows in this stack
+                for (const flow of poppedStack) {
+                    TransactionManager.fail(flow.transaction, `System rebooted to flow ${subFlow.name}`);
+                    exitedFlows.push(flow.flowName);
+                    auditLogger.logFlowExit(flow.flowName, currentFlowFrame.userId, flow.transaction.id, 'system_reboot');
+                }
+            }
+            // Initialize completely fresh stack system (using proven pattern)
             initializeFlowStacks(engine);
-            // Start the sub-flow as a new root flow
-            const transaction = new FlowTransaction(subFlow.name, 'reboot', currentFlowFrame.userId);
+            // Start the reboot flow as the only flow in the system
+            const transaction = TransactionManager.create(subFlow.name, 'reboot', currentFlowFrame.userId);
             pushToCurrentStack(engine, {
                 flowName: subFlow.name,
                 flowId: subFlow.id,
@@ -2913,6 +3014,7 @@ async function handleSubFlowStep(currentFlowFrame, engine) {
                 startTime: Date.now()
             });
             auditLogger.logFlowStart(subFlow.name, input, currentFlowFrame.userId, transaction.id);
+            logger.info(`System completely rebooted to flow ${subFlow.name}. Exited flows: ${exitedFlows.join(', ')}`);
             return `System rebooted to flow ${subFlow.name}`;
         }
         else if (callType === "replace") {
@@ -2927,15 +3029,15 @@ async function handleSubFlowStep(currentFlowFrame, engine) {
             addToContextStack(currentFlowFrame.contextStack, 'user', input);
             currentFlowFrame.inputStack.push(input);
             // Update transaction
-            currentFlowFrame.transaction.fail(`Replaced by flow ${subFlow.name}`);
-            currentFlowFrame.transaction = new FlowTransaction(subFlow.name, 'replacement', currentFlowFrame.userId);
+            TransactionManager.fail(currentFlowFrame.transaction, `Replaced by flow ${subFlow.name}`);
+            currentFlowFrame.transaction = TransactionManager.create(subFlow.name, 'replacement', currentFlowFrame.userId);
             auditLogger.logFlowStart(subFlow.name, input, currentFlowFrame.userId, currentFlowFrame.transaction.id);
             logger.debug(`About to return from handleSubFlowStep replacement, flowStepsStack length: ${currentFlowFrame.flowStepsStack.length}`);
             return `Flow replaced with ${subFlow.name}`;
         }
         else { // callType === "call" (default)
             // Normal sub-flow call - create new transaction for sub-flow
-            const subTransaction = new FlowTransaction(subFlow.name, 'sub-flow', currentFlowFrame.userId);
+            const subTransaction = TransactionManager.create(subFlow.name, 'sub-flow', currentFlowFrame.userId);
             // Push sub-flow onto stack - INHERIT parent's variables for unified scope
             pushToCurrentStack(engine, {
                 flowName: subFlow.name,
@@ -2963,7 +3065,7 @@ async function handleSubFlowStep(currentFlowFrame, engine) {
     }
 }
 // === TOOL CALLING AND ARGUMENT GENERATION SYSTEM ===
-async function generateToolCallAndResponse(engine, toolName, input, contextStack = [], userId = 'anonymous', transactionId = null, flowFrame = null, explicitArgs) {
+async function generateToolCallAndResponse(engine, toolName, input, contextStack = [], userId = 'anonymous', transactionId = null, flowFrame, explicitArgs) {
     try {
         const toolsRegistry = engine.toolsRegistry;
         if (!toolsRegistry) {
@@ -2991,7 +3093,7 @@ async function generateToolCallAndResponse(engine, toolName, input, contextStack
                 const contextStack = flowFrame.contextStack || [];
                 logger.debug(`Interpolating args templates:`, rawArgs);
                 logger.debug(`Available variables:`, variables);
-                rawArgs = interpolateObject(rawArgs, variables, variables);
+                rawArgs = interpolateObject(rawArgs, variables, {}, engine);
                 logger.debug(`Interpolated args:`, rawArgs);
             }
             catch (error) {
@@ -3007,7 +3109,7 @@ async function generateToolCallAndResponse(engine, toolName, input, contextStack
         throw error;
     }
 }
-async function generateToolArgs(schema, input, contextStack = [], flowFrame = null, engine) {
+async function generateToolArgs(schema, input, contextStack = [], flowFrame, engine) {
     try {
         if (!schema || typeof schema !== 'object') {
             logger.warn(`Invalid schema provided for argument generation: ${schema}`);
@@ -3047,7 +3149,7 @@ async function generateToolArgs(schema, input, contextStack = [], flowFrame = nu
         throw new Error(`Failed to generate tool arguments: ${error.message}`);
     }
 }
-async function generateArgsWithAI(schema, input, contextStack, flowFrame = null, engine) {
+async function generateArgsWithAI(schema, input, contextStack, flowFrame, engine) {
     const properties = schema.properties || {};
     const required = schema.required || [];
     const schemaDescription = Object.entries(properties)
@@ -3134,7 +3236,7 @@ Context Extraction Examples:
     }
 }
 // Enhanced pattern-based fallback that uses variables and input parsing
-function generateEnhancedFallbackArgs(schema, input, flowFrame = null) {
+function generateEnhancedFallbackArgs(schema, input, flowFrame) {
     const properties = schema.properties || {};
     const required = schema.required || [];
     const args = {};
@@ -3146,6 +3248,11 @@ function generateEnhancedFallbackArgs(schema, input, flowFrame = null) {
             // Direct variable match
             if (flowFrame.variables[key] !== undefined) {
                 let value = flowFrame.variables[key];
+                // Handle user input wrapper objects
+                if (isUserInputVariable(value)) {
+                    const userInputObj = value;
+                    value = userInputObj.value;
+                }
                 // Type conversion if needed
                 if (prop.type === 'number' && typeof value === 'string') {
                     const num = parseFloat(value);
@@ -3156,37 +3263,6 @@ function generateEnhancedFallbackArgs(schema, input, flowFrame = null) {
                 args[key] = value;
                 continue;
             }
-            // Smart matching for account numbers
-            if (key.includes('account')) {
-                const accountVar = Object.keys(flowFrame.variables).find(varName => varName.includes('account') || (typeof flowFrame.variables[varName] === 'object' &&
-                    flowFrame.variables[varName] !== null &&
-                    flowFrame.variables[varName]?.accountId));
-                if (accountVar) {
-                    const accountData = flowFrame.variables[accountVar];
-                    if (typeof accountData === 'object' && accountData !== null && 'accountId' in accountData) {
-                        args[key] = accountData.accountId;
-                    }
-                    else if (typeof accountData === 'string') {
-                        args[key] = accountData;
-                    }
-                }
-            }
-            // Smart matching for amounts
-            if (key.includes('amount')) {
-                const amountVar = Object.keys(flowFrame.variables).find(varName => varName.includes('amount') || varName.includes('payment'));
-                if (amountVar) {
-                    const amountData = flowFrame.variables[amountVar];
-                    if (typeof amountData === 'number') {
-                        args[key] = amountData;
-                    }
-                    else if (typeof amountData === 'string') {
-                        const num = parseFloat(amountData);
-                        if (!isNaN(num)) {
-                            args[key] = num;
-                        }
-                    }
-                }
-            }
         }
     }
     // If enhanced fallback didn't find anything useful, try simple pattern matching
@@ -3249,18 +3325,102 @@ async function callTool(engine, tool, args, userId = 'anonymous', transactionId
             if (!APPROVED_FUNCTIONS) {
                 throw new Error(`Approved functions registry not available`);
             }
-            const fn = APPROVED_FUNCTIONS.get(tool.implementation.function);
+            const fn = APPROVED_FUNCTIONS[tool.implementation.function];
             if (!fn) {
                 throw new Error(`Function "${tool.implementation.function}" not found in approved functions registry`);
             }
             // Apply timeout if configured
             const timeout = tool.implementation.timeout || 5000;
-            const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error(`Tool execution timeout after ${timeout}ms`)), timeout));
+            let timeoutId;
+            const timeoutPromise = new Promise((_, reject) => {
+                timeoutId = setTimeout(() => reject(new Error(`Tool execution timeout after ${timeout}ms - ${tool.implementation.function}`)), timeout);
+            });
             try {
-                const result = await Promise.race([fn(args), timeoutPromise]);
+                // Determine how to call the function based on its signature and tool schema
+                let result;
+                // Check if the tool schema indicates individual parameters vs object parameter
+                const toolSchema = tool.schema || tool.parameters || tool;
+                // Handle different schema formats:
+                // Format 1: JSONSchema with type="object" -> single object parameter
+                // Format 2: Direct parameters object -> individual parameters
+                let schemaProperties = {};
+                let useObjectParameter = false;
+                if (tool.parameters?.type === "object" && tool.parameters?.properties) {
+                    // Format 1: JSONSchema format { type: "object", properties: {...} }
+                    // Function expects single object parameter
+                    schemaProperties = tool.parameters.properties;
+                    useObjectParameter = true;
+                    logger.debug(`Detected JSONSchema format (type: object) - will use object parameter`);
+                }
+                else if (tool.parameters && typeof tool.parameters === 'object' && !tool.parameters.type) {
+                    // Format 2: Direct parameters { param1: {...}, param2: {...} }
+                    // Function expects individual parameters
+                    schemaProperties = tool.parameters;
+                    useObjectParameter = false;
+                    logger.debug(`Detected direct parameters format - will use individual parameters`);
+                }
+                else if (toolSchema?.properties) {
+                    // Fallback: Standard JSONSchema format
+                    schemaProperties = toolSchema.properties;
+                    useObjectParameter = toolSchema.type === "object";
+                    logger.debug(`Detected schema.properties format - object parameter: ${useObjectParameter}`);
+                }
+                const propertyNames = Object.keys(schemaProperties);
+                // Get function parameter count
+                const fnParamCount = fn.length;
+                logger.debug(`Function ${tool.implementation.function} parameter count: ${fnParamCount}`);
+                logger.debug(`Schema properties count: ${propertyNames.length}`);
+                logger.debug(`Schema properties: ${propertyNames.join(', ')}`);
+                logger.debug(`Use object parameter: ${useObjectParameter}`);
+                // Strategy 1: If schema explicitly indicates object parameter OR function expects 1 param
+                if (useObjectParameter || fnParamCount === 1) {
+                    logger.debug(`Calling function with single object parameter`);
+                    result = await Promise.race([fn(args), timeoutPromise]);
+                }
+                // Strategy 2: If function expects multiple parameters and we have multiple schema properties
+                else if (fnParamCount > 1 && propertyNames.length > 1) {
+                    logger.debug(`Calling function with individual parameters (${fnParamCount} params expected)`);
+                    // For tools with 'parameters' property, use the required array or property order
+                    let orderedParamNames;
+                    if (tool.required && Array.isArray(tool.required)) {
+                        // Use required array order first, then add any optional parameters
+                        const optionalParams = propertyNames.filter(name => !tool.required.includes(name));
+                        orderedParamNames = [...tool.required, ...optionalParams];
+                    }
+                    else {
+                        // Fall back to property definition order (note: this may not be reliable in all JS engines)
+                        orderedParamNames = propertyNames;
+                    }
+                    logger.debug(`Parameter order: ${orderedParamNames.join(', ')}`);
+                    const orderedArgs = orderedParamNames.map(propName => {
+                        const value = args[propName];
+                        logger.debug(`Parameter ${propName}: ${JSON.stringify(value)}`);
+                        return value;
+                    });
+                    logger.debug(`Calling ${tool.implementation.function}(${orderedArgs.map(arg => typeof arg === 'object' ? '[object]' : arg).join(', ')})`);
+                    result = await Promise.race([fn(...orderedArgs), timeoutPromise]);
+                }
+                // Strategy 3: Function expects 0 parameters, call without arguments
+                else if (fnParamCount === 0) {
+                    logger.debug(`Calling function with no parameters`);
+                    result = await Promise.race([fn(), timeoutPromise]);
+                }
+                // Fallback: Use object approach
+                else {
+                    logger.debug(`Calling function with object parameter (fallback)`);
+                    result = await Promise.race([fn(args), timeoutPromise]);
+                }
+                // Clear the timeout since function completed successfully
+                if (timeoutId) {
+                    clearTimeout(timeoutId);
+                }
                 return result;
             }
             catch (error) {
+                // Clear the timeout on error as well
+                if (timeoutId) {
+                    clearTimeout(timeoutId);
+                }
                 // Unconditional Retry logic for local functions
                 const retries = tool.implementation.retries || 0;
                 if (retries > 0) {
@@ -3297,7 +3457,7 @@ async function callHttpTool(tool, args, userId = 'anonymous', transactionId = nu
             // Apply response mapping if configured
             if (implementation.responseMapping) {
                 try {
-                    const mappedResult = applyResponseMapping(mockData, implementation.responseMapping, args);
+                    const mappedResult = applyResponseMapping(mockData, implementation.responseMapping, args, engine);
                     logger.info(`[MOCK] Response mapping applied for ${tool.name}`);
                     return mappedResult;
                 }
@@ -3571,7 +3731,7 @@ async function callHttpTool(tool, args, userId = 'anonymous', transactionId = nu
                     // Apply declarative response mapping if configured (preferred)
                     if (implementation.responseMapping) {
                         try {
-                            return applyResponseMapping(data, implementation.responseMapping, mappingArgs);
+                            return applyResponseMapping(data, implementation.responseMapping, mappingArgs, engine);
                         }
                         catch (error) {
                             logger.error(`Response mapping failed:`, error.message);
@@ -3735,10 +3895,115 @@ export async function portableHash(data, secret, algorithm = 'SHA-256', encoding
         return encoding === 'base64' ? arrayBufferToBase64(hash) : Array.from(new Uint8Array(hash)).map(b => b.toString(16).padStart(2, '0')).join('');
     }
 }
-// Unified expression evaluator - replaces both evaluateSafeExpression and evaluateSafeCondition
+/**
+ * Resolve variable path like "cargo.callerId" or "user.profile.name"
+ * Supports variables, context stack, engine session variables, and global variables
+ */
+function resolveVariablePath(path, variables, contextStack, engine) {
+    const parts = path.split('.');
+    const rootVar = parts[0];
+    // 1. Try to find in flow variables first
+    let rootValue = variables[rootVar];
+    // Handle user input variables as pure literals
+    if (rootValue && typeof rootValue === 'object' && rootValue !== null) {
+        const userInputObj = rootValue;
+        if (userInputObj.__userInput === true && userInputObj.__literal === true) {
+            // Extract the literal value and treat it as a normal variable
+            // This allows normal property access like userInput.length
+            rootValue = userInputObj.value;
+        }
+        else {
+            logger.debug(`resolveVariablePath - Found user input object, but not a literal: ${JSON.stringify(userInputObj)}`);
+        }
+    }
+    // 2. If not found in variables, try context stack
+    if (rootValue === undefined && contextStack.length > 0) {
+        for (const context of contextStack) {
+            if (context && typeof context === 'object' && rootVar in context) {
+                rootValue = context[rootVar];
+                break;
+            }
+        }
+    }
+    // 3. If not found and engine available, try engine session variables
+    if (rootValue === undefined && engine) {
+        // Use the centralized session variable logic
+        const sessionVars = getEngineSessionVariables(engine, contextStack);
+        // Handle property access (e.g., cargo.someVar)
+        if (path.includes('.')) {
+            const parts = path.split('.');
+            const baseVariable = parts[0];
+            const propertyPath = parts.slice(1).join('.');
+            // Get the base session variable
+            const baseValue = sessionVars[baseVariable];
+            // If we found a base value, navigate the remaining path
+            if (baseValue !== undefined) {
+                return resolveVariablePath(propertyPath, { root: baseValue }, [], engine);
+            }
+        }
+        else {
+            // Handle direct variable access (no dots)
+            rootValue = sessionVars[path];
+        }
+    }
+    // 4. If not found and engine available, try global variables
+    if (rootValue === undefined && engine?.globalVariables) {
+        rootValue = engine.globalVariables[rootVar];
+    }
+    // If still not found, return undefined
+    if (rootValue === undefined) {
+        return undefined;
+    }
+    // Navigate the remaining path safely
+    let current = rootValue;
+    for (let i = 1; i < parts.length; i++) {
+        if (current === null || current === undefined) {
+            return undefined;
+        }
+        if (typeof current === 'object' && current !== null) {
+            current = current[parts[i]];
+        }
+        else {
+            return undefined;
+        }
+    }
+    return current;
+}
+/**
+ * Check if a variable value is marked as user input (literal data)
+ * User input should never be evaluated as code for security
+ */
+function isUserInputVariable(value) {
+    return (value !== null &&
+        typeof value === 'object' &&
+        value.__userInput === true &&
+        value.__literal === true);
+}
+/**
+ * Input sanitization for user-provided values
+ * Escapes special characters that could break expression syntax
+ * NOTE: This is secondary defense - primary security is treating user input as literal data
+ */
+function sanitizeUserInput(input) {
+    if (typeof input !== 'string') {
+        return String(input);
+    }
+    // Escape special characters that could break expression syntax
+    return input
+        .replace(/\\/g, '\\\\') // Escape backslashes
+        .replace(/'/g, "\\'") // Escape single quotes  
+        .replace(/"/g, '\\"') // Escape double quotes
+        .replace(/\n/g, '\\n') // Escape newlines
+        .replace(/\r/g, '\\r') // Escape carriage returns
+        .replace(/\t/g, '\\t'); // Escape tabs
+}
+/**
+ * Simplified Expression Evaluator
+ * Replaced complex two-phase parser with regex + JavaScript evaluation for 100% reliability
+ */
 function evaluateExpression(expression, variables = {}, contextStack = [], options = {}, engine) {
     const opts = {
-        securityLevel: 'standard',
+        securityLevel: 'basic',
         allowLogicalOperators: true,
         allowMathOperators: true,
         allowComparisons: true,
@@ -3748,330 +4013,56 @@ function evaluateExpression(expression, variables = {}, contextStack = [], optio
         ...options
     };
     try {
-        logger.debug(`Evaluating expression: ${expression} with options: ${JSON.stringify(opts)}`);
-        // Security check with configurable level
-        if (containsUnsafePatterns(expression, opts, engine)) {
-            logger.warn(`Blocked unsafe expression in ${opts.context}: ${expression}`);
-            return opts.returnType === 'boolean' ? false : `[blocked: ${expression}]`;
-        }
-        // Special handling for boolean return type with template expressions
-        // If the entire expression is wrapped in {{ }} and we want a boolean, 
-        // evaluate the inner expression directly without string conversion
-        if (opts.returnType === 'boolean' && expression.startsWith('{{') && expression.endsWith('}}')) {
-            const innerExpression = expression.slice(2, -2).trim();
-            const result = evaluateExpression(innerExpression, variables, contextStack, {
-                ...opts,
-                returnType: 'boolean'
-            }, engine);
-            return result;
-        }
-        // First, check if this is a comparison or logical expression with template variables
-        let processedExpression = expression;
-        // If it has template variables, interpolate them first (for non-boolean contexts)
-        while (processedExpression.includes('{{') && processedExpression.includes('}}')) {
-            processedExpression = interpolateTemplateVariables(processedExpression, variables, contextStack, opts, engine);
-        }
-        // Now check the processed expression for operators (after template interpolation)
-        // Handle logical AND/OR expressions (if allowed)
-        if (opts.allowLogicalOperators && (processedExpression.includes('&&') || processedExpression.includes('||'))) {
-            const result = evaluateLogicalExpression(processedExpression, variables, contextStack, opts, engine);
-            return convertReturnType(result, opts.returnType);
-        }
-        // Handle comparison expressions (if allowed)
-        if (opts.allowComparisons && containsComparisonOperators(processedExpression)) {
-            const result = evaluateComparisonExpression(processedExpression, variables, contextStack, opts, engine);
-            return convertReturnType(result, opts.returnType);
-        }
-        // Handle ternary expressions (if allowed)
-        if (opts.allowTernary && processedExpression.includes('?') && processedExpression.includes(':')) {
-            const result = evaluateSafeTernaryExpression(processedExpression, variables, contextStack, engine);
-            return convertReturnType(result, opts.returnType);
-        }
-        // Handle mathematical expressions (if allowed)
-        if (opts.allowMathOperators && isMathematicalExpression(processedExpression)) {
-            const result = evaluateSafeMathematicalExpression(processedExpression, variables, contextStack, engine);
-            return convertReturnType(result, opts.returnType);
-        }
-        // Handle simple variable paths (e.g., "user.name", "data.items.length")
-        if (isSimpleVariablePath(processedExpression)) {
-            const result = resolveSimpleVariable(processedExpression, variables, contextStack, engine);
-            return convertReturnType(result, opts.returnType);
-        }
-        // Handle function calls (e.g., "currentTime()", "extractCryptoFromInput(...)")
-        if (processedExpression.includes('(') && processedExpression.includes(')')) {
-            const result = evaluateFunctionCall(processedExpression, variables, contextStack, engine);
-            if (result !== undefined) {
-                return convertReturnType(result, opts.returnType);
-            }
-        }
-        // If no pattern matches and we had template variables, return the interpolated result
-        if (processedExpression !== expression) {
-            return convertReturnType(processedExpression, opts.returnType);
-        }
-        // Fallback: treat as literal
-        const result = expression;
-        return convertReturnType(result, opts.returnType);
-    }
-    catch (error) {
-        logger.warn(`Expression evaluation error in ${opts.context}: ${error.message}`);
-        return opts.returnType === 'boolean' ? false : `[error: ${expression}]`;
-    }
-}
-// Unified security pattern checking with configurable levels
-function containsUnsafePatterns(expression, options, engine) {
-    const { securityLevel = 'standard', allowLogicalOperators = true, allowComparisons = true } = options;
-    // Safe string methods that are allowed in expressions
-    const safeStringMethods = [
-        'toLowerCase', 'toUpperCase', 'trim', 'charAt', 'charCodeAt', 'indexOf', 'lastIndexOf',
-        'substring', 'substr', 'slice', 'split', 'replace', 'match', 'search', 'includes',
-        'startsWith', 'endsWith', 'padStart', 'padEnd', 'repeat', 'toString', 'valueOf',
-        'length', 'concat', 'localeCompare', 'normalize'
-    ];
-    // Safe array methods that are allowed in expressions
-    const safeArrayMethods = [
-        'length', 'join', 'indexOf', 'lastIndexOf', 'includes', 'slice', 'toString', 'valueOf'
-    ];
-    // Safe math methods that are allowed in expressions
-    const safeMathMethods = [
-        'abs', 'ceil', 'floor', 'round', 'max', 'min', 'pow', 'sqrt', 'random'
-    ];
-    // Safe standalone functions that are allowed
-    const safeStandaloneFunctions = [
-        'isNaN', 'isFinite', 'parseInt', 'parseFloat',
-        'encodeURIComponent', 'decodeURIComponent', 'encodeURI', 'decodeURI',
-        'String', 'Number', 'Boolean' // Type conversion functions (not new constructors)
-    ];
-    // Check if expression contains only safe function calls
-    const functionCallPattern = /(\w+)\.(\w+)\s*\(/g;
-    const standaloneFunctionPattern = /(?:^|[^.\w])(\w+)\s*\(/g;
-    let match;
-    const foundFunctionCalls = [];
-    // First, check for any standalone function calls (not methods)
-    standaloneFunctionPattern.lastIndex = 0; // Reset regex
-    while ((match = standaloneFunctionPattern.exec(expression)) !== null) {
-        const functionName = match[1];
-        // Skip if this is actually a method call (preceded by a dot)
-        const beforeFunction = expression.substring(0, match.index + match[0].indexOf(functionName));
-        if (!beforeFunction.endsWith('.')) {
-            // Check if this standalone function is in our safe list or approved functions
-            const isApprovedFunction = engine.APPROVED_FUNCTIONS?.get &&
-                typeof engine.APPROVED_FUNCTIONS.get(functionName) === 'function';
-            if (!safeStandaloneFunctions.includes(functionName) && !isApprovedFunction) {
-                logger.debug(`Blocking unsafe standalone function call: ${functionName}`);
-                return true; // Unsafe standalone function calls are not allowed
-            }
-            logger.debug(`Allowing safe standalone function call: ${functionName}${isApprovedFunction ? ' (approved)' : ' (built-in)'}`);
-        }
-    }
-    // Then, check method calls and verify they're safe
-    functionCallPattern.lastIndex = 0; // Reset regex
-    while ((match = functionCallPattern.exec(expression)) !== null) {
-        const methodName = match[2];
-        foundFunctionCalls.push(methodName);
-        // If this method is not in our safe lists, it's potentially unsafe
-        if (!safeStringMethods.includes(methodName) &&
-            !safeArrayMethods.includes(methodName) &&
-            !safeMathMethods.includes(methodName)) {
-            logger.debug(`Blocking unsafe method call: ${methodName}`);
-            return true; // Unsafe method found
-        }
-    }
-    // Core dangerous patterns (blocked at all levels) - removed the problematic function call pattern
-    const coreDangerousPatterns = [
-        /eval\s*\(/, // eval() calls
-        /Function\s*\(/, // Function constructor
-        /constructor/, // Constructor access
-        /prototype/, // Prototype manipulation  
-        /__proto__/, // Prototype access
-        /import\s*\(/, // Dynamic imports
-        /require\s*\(/, // CommonJS requires
-        /process\./, // Process access
-        /global\./, // Global access
-        /window\./, // Window access (browser)
-        /document\./, // Document access (browser)
-        /console\./, // Console access
-        /setTimeout/, // Timer functions
-        /setInterval/, // Timer functions
-        /fetch\s*\(/, // Network requests
-        /XMLHttpRequest/, // Network requests
-        /localStorage/, // Storage access
-        /sessionStorage/, // Storage access
-        /\+\s*\+/, // Increment operators
-        /--/, // Decrement operators
-        /(?<![=!<>])=(?!=)/, // Assignment operators = (but not ==, !=, <=, >=)
-        /delete\s+/, // Delete operator
-        /new\s+/, // Constructor calls
-        /throw\s+/, // Throw statements
-        /try\s*\{/, // Try blocks
-        /catch\s*\(/, // Catch blocks
-        /finally\s*\{/, // Finally blocks
-        /for\s*\(/, // For loops
-        /while\s*\(/, // While loops
-        /do\s*\{/, // Do-while loops
-        /switch\s*\(/, // Switch statements
-        /return\s+/, // Return statements
-    ];
-    // Additional strict patterns (only blocked in strict mode)
-    const strictOnlyPatterns = [
-        /\[.*\]/, // Array/object bracket notation
-        /this\./, // This access
-        /arguments\./, // Arguments access
-    ];
-    // Check core patterns (function call validation is handled separately above)
-    if (coreDangerousPatterns.some(pattern => pattern.test(expression))) {
-        return true;
-    }
-    // Check strict-only patterns if in strict mode
-    if (securityLevel === 'strict' && strictOnlyPatterns.some(pattern => pattern.test(expression))) {
-        return true;
-    }
-    return false;
-}
-// Template variable interpolation ({{variable}} format) with nested support
-// Inside-out approach: process innermost {{}} expressions first, then repeat until no more changes
-function interpolateTemplateVariables(template, variables, contextStack, options, engine) {
-    logger.debug(`Starting template interpolation: ${template}`);
-    let result = template;
-    let iterations = 0;
-    const maxIterations = 10; // Prevent infinite loops
-    while (result.includes('{{') && result.includes('}}') && iterations < maxIterations) {
-        iterations++;
-        logger.debug(`Template interpolation iteration ${iterations}: ${result}`);
-        // Find the LAST (rightmost) {{ - this is the innermost opening
-        const lastOpenIndex = result.lastIndexOf('{{');
-        if (lastOpenIndex === -1)
-            break;
-        // From that position, find the FIRST }} - this is the matching closing
-        const closeIndex = result.indexOf('}}', lastOpenIndex);
-        if (closeIndex === -1) {
-            logger.error(`Found {{ at ${lastOpenIndex} but no matching }} in: ${result}`);
-            return 'Invalid template!';
-        }
-        // Extract the innermost expression
-        const expression = result.substring(lastOpenIndex + 2, closeIndex).trim();
-        logger.debug(`Found innermost template expression: {{${expression}}}`);
-        // Evaluate the innermost expression
-        const evaluatedContent = evaluateExpression(expression, variables, contextStack, {
-            ...options,
-            returnType: 'string'
-        }, engine);
-        const replacement = typeof evaluatedContent === 'string' ? evaluatedContent : String(evaluatedContent);
-        logger.debug(`Evaluated to: ${replacement}`);
-        // Replace the template expression with its evaluated result
-        result = result.substring(0, lastOpenIndex) + replacement + result.substring(closeIndex + 2);
-        logger.debug(`After replacement: ${result}`);
-    }
-    if (iterations >= maxIterations) {
-        logger.warn(`Template interpolation stopped after ${maxIterations} iterations to prevent infinite loop`);
-    }
-    logger.debug(`Final template result: ${result}`);
-    return result;
-}
-// Logical expression evaluator (&&, ||)
-function evaluateLogicalExpression(expression, variables, contextStack, options, engine) {
-    // Handle OR expressions
-    if (expression.includes('||')) {
-        return evaluateSafeOrExpression(expression, variables, contextStack, engine);
-    }
-    // Handle AND expressions
-    if (expression.includes('&&')) {
-        const parts = expression.split('&&').map(part => part.trim());
-        for (const part of parts) {
-            const partResult = evaluateExpression(part, variables, contextStack, {
-                ...options,
-                returnType: 'boolean'
-            }, engine);
-            if (!partResult) {
-                return false;
+        logger.debug(`Simplified evaluation starting: ${expression}`);
+        // If not a string, return as-is
+        if (typeof expression !== 'string') {
+            return expression;
+        }
+        // Simple regex to find {{expression}} patterns
+        const expressionRegex = /\{\{([^}]+)\}\}/g;
+        // Create evaluation context by merging all available variables
+        const context = createSimplifiedEvaluationContext(variables, contextStack, engine);
+        // Check if the entire expression is a single interpolation
+        const singleExpressionMatch = expression.match(/^\{\{([^}]+)\}\}$/);
+        if (singleExpressionMatch) {
+            // Single expression - return the evaluated result directly to preserve type
+            try {
+                const evaluationResult = evaluateJavaScriptExpression(singleExpressionMatch[1].trim(), context);
+                logger.debug(`Simplified evaluation complete (single): ${expression} -> ${evaluationResult}`);
+                return convertReturnType(evaluationResult, opts.returnType);
+            }
+            catch (error) {
+                const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+                logger.warn(`Single expression evaluation failed: ${singleExpressionMatch[1]} - ${errorMessage}`);
+                return opts.returnType === 'boolean' ? false : `[error: ${expression}]`;
             }
         }
-        return true;
-    }
-    return false;
-}
-// Comparison expression evaluator (==, !=, <, >, <=, >=)
-function evaluateComparisonExpression(expression, variables, contextStack, options, engine) {
-    // For comparison expressions, we need to handle variable substitution properly
-    let processedExpression = expression;
-    // Find all variable references (not in template format) and replace them
-    // This handles cases like "input.toLowerCase()" where input is a variable
-    const variableNames = Object.keys(variables);
-    for (const varName of variableNames) {
-        const varValue = variables[varName];
-        // Create a regex to match the variable name as a whole word
-        const varRegex = new RegExp(`\\b${varName}\\b`, 'g');
-        // Replace variable references with their values, properly quoted for strings
-        processedExpression = processedExpression.replace(varRegex, (match) => {
-            if (typeof varValue === 'string') {
-                logger.debug(`Replacing variable '${varName}' with string value: ${varValue}`);
-                return `"${varValue}"`;
-            }
-            else if (typeof varValue === 'boolean' || typeof varValue === 'number') {
-                logger.debug(`Replacing variable '${varName}' with value: ${varValue}`);
-                return varValue.toString();
-            }
-            else if (varValue === null || varValue === undefined) {
-                logger.debug(`Replacing variable '${varName}' with null value`);
-                return 'null';
+        // Multiple expressions or mixed content - convert to string
+        const result = expression.replace(expressionRegex, (match, expr) => {
+            try {
+                // Direct JavaScript evaluation with injected variables
+                const evaluationResult = evaluateJavaScriptExpression(expr.trim(), context);
+                return String(evaluationResult);
             }
-            else {
-                logger.debug(`Replacing variable '${varName}' with JSON value:`, varValue);
-                return JSON.stringify(varValue);
+            catch (error) {
+                const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+                logger.warn(`Expression evaluation failed: ${expr} - ${errorMessage}`);
+                return match; // Return original if evaluation fails
             }
         });
-    }
-    // Handle any remaining {{variable}} template expressions
-    const variableMatches = processedExpression.match(/\{\{([^}]+)\}\}/g);
-    if (variableMatches) {
-        for (const match of variableMatches) {
-            const varName = match.slice(2, -2).trim();
-            let varValue = getNestedValue(variables, varName);
-            logger.debug(`Resolving template variable '${varName}' with value:`, varValue);
-            // Check engine session variables if not found
-            if (varValue === undefined && engine) {
-                varValue = resolveEngineSessionVariable(varName, engine);
-            }
-            // Convert value to appropriate type for comparison
-            let replacementValue;
-            if (varValue === undefined || varValue === null) {
-                replacementValue = 'null';
-            }
-            else if (typeof varValue === 'string') {
-                replacementValue = `"${varValue}"`;
-            }
-            else if (typeof varValue === 'boolean') {
-                replacementValue = varValue.toString();
-            }
-            else {
-                replacementValue = varValue.toString();
-            }
-            processedExpression = processedExpression.replace(match, replacementValue);
-        }
-    }
-    logger.debug(`Comparison expression after variable substitution: ${processedExpression}`);
-    try {
-        // Use Function constructor for safe evaluation
-        const result = new Function('return ' + processedExpression)();
-        logger.debug(`Comparison evaluation result: ${result}`);
-        return !!result; // Convert to boolean
+        logger.debug(`Simplified evaluation complete: ${expression} -> ${result}`);
+        return convertReturnType(result, opts.returnType);
     }
     catch (error) {
-        logger.info(`Comparison evaluation failed for '${expression}':`, error.message);
-        return false;
+        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+        logger.warn(`Simplified evaluation error: ${errorMessage}`);
+        return opts.returnType === 'boolean' ? false : `[error: ${expression}]`;
     }
 }
-// Helper function to check for comparison operators
-function containsComparisonOperators(expression) {
-    return /[<>=!]+/.test(expression) &&
-        !(expression.includes('&&') || expression.includes('||')); // Not a logical expression
-}
-// Helper function to check for mathematical expressions
-function isMathematicalExpression(expression) {
-    return /[\+\-\*\/\%]/.test(expression) &&
-        !expression.includes('++') &&
-        !expression.includes('--'); // Exclude increment/decrement
-}
-// Convert result to requested return type
+/**
+ * Convert result to requested return type
+ * Enhanced version with better type handling
+ */
 function convertReturnType(value, returnType) {
     switch (returnType) {
         case 'boolean':
@@ -4083,447 +4074,158 @@ function convertReturnType(value, returnType) {
             return value;
     }
 }
-// Clean unified expression interface functions  
+/**
+ * Get engine session variables for simplified evaluator
+ * This is the SINGLE SOURCE OF TRUTH for session variable logic
+ */
+function getEngineSessionVariables(engine, contextStack) {
+    const sessionVars = {};
+    try {
+        const currentFlowFrame = getCurrentFlowFrame(engine);
+        // Get userInput from the most recent user entry in context stack
+        const userEntries = currentFlowFrame.contextStack.filter(entry => entry.role === 'user');
+        if (userEntries.length > 0) {
+            const lastUserEntry = userEntries[userEntries.length - 1];
+            const userInputValue = typeof lastUserEntry.content === 'string' ? lastUserEntry.content : String(lastUserEntry.content);
+            sessionVars.userInput = userInputValue;
+            sessionVars.lastUserInput = userInputValue; // alias
+        }
+        // Add other engine session variables
+        sessionVars.cargo = engine.cargo || {};
+        sessionVars.sessionId = engine.sessionId;
+        sessionVars.userId = currentFlowFrame.userId;
+        sessionVars.flowName = currentFlowFrame.flowName;
+        // Special function-like variables
+        sessionVars['currentTime()'] = new Date().toISOString();
+        // Add global variables if available
+        if (engine.globalVariables) {
+            Object.assign(sessionVars, engine.globalVariables);
+        }
+    }
+    catch (error) {
+        logger.debug(`Error getting engine session variables: ${error}`);
+    }
+    return sessionVars;
+}
+/**
+ * Create evaluation context with all available variables for simplified evaluator
+ */
+function createSimplifiedEvaluationContext(variables, contextStack, engine) {
+    // Just use the provided variables - contextStack is primarily for conversation history
+    const allVars = variables || {};
+    // Get engine session variables
+    const engineSessionVars = getEngineSessionVariables(engine, contextStack);
+    const context = {
+        // All variables as top-level properties
+        ...allVars,
+        // Engine session variables (userInput, cargo, sessionId, etc.)
+        ...engineSessionVars,
+        // Special variables that should always be available
+        $args: variables?.$args || {},
+        xml_result: variables?.xml_result,
+        json_result: variables?.json_result,
+        // Add context object for Object.keys() patterns (avoid 'this' keyword issues)
+        currentContext: { ...allVars, ...engineSessionVars },
+        // Include approved functions so they can be called in expressions
+        ...engine.APPROVED_FUNCTIONS,
+        // Utility objects available in expressions
+        Object,
+        Date,
+        Math,
+        String,
+        Number,
+        Boolean,
+        Array,
+        JSON
+    };
+    return context;
+}
+/**
+ * Safely evaluate JavaScript expression with injected context
+ */
+function evaluateJavaScriptExpression(expression, context) {
+    // Filter to only valid JavaScript identifiers (root variables only)
+    const validParamNames = Object.keys(context).filter(key => /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(key));
+    // Unwrap user input variables before passing to function
+    const paramValues = validParamNames.map(name => {
+        const value = context[name];
+        // Unwrap user input wrapper objects
+        if (value && typeof value === 'object' &&
+            value.__userInput === true &&
+            value.__literal === true) {
+            return value.value;
+        }
+        return value;
+    });
+    // Build function body that evaluates the expression
+    const functionBody = `
+    "use strict";
+    try {
+      const result = (${expression});
+      // Auto-stringify complex data structures when used in string contexts
+      if (typeof result === 'object' && result !== null &&
+          !(result.__userInput === true && result.__literal === true)) {
+        return JSON.stringify(result);
+      }
+      return result;
+    } catch (e) {
+      throw new Error('Expression evaluation failed: ' + e.message);
+    }
+  `;
+    // Create and execute function with only valid parameter names
+    const evaluatorFunction = new Function(...validParamNames, functionBody);
+    return evaluatorFunction(...paramValues);
+}
+/**
+ * Security-aware variable setter for user input
+ * Integrates with the variable resolution system
+ */
+function setUserInputVariable(variables, key, value, sanitize = true) {
+    // Mark user input as static literal data that should never be evaluated as code
+    variables[key] = {
+        __userInput: true,
+        __literal: true,
+        value: sanitize && typeof value === 'string' ? sanitizeUserInput(value) : value
+    };
+}
+// ===============================================
+// LEGACY COMPATIBILITY FUNCTIONS
+// ===============================================
+/**
+ * Clean unified expression interface functions
+ * Maintains backward compatibility with existing code
+ */
 function interpolateMessage(template, contextStack, variables = {}, engine) {
     logger.debug(`Interpolating message template: ${template} with variables: ${JSON.stringify(variables)}`);
     if (!template)
         return template;
-    // Use our enhanced template interpolation that supports nested {{ }} expressions
-    return interpolateTemplateVariables(template, variables, contextStack, {
-        securityLevel: 'standard',
+    // For template interpolation, we should NOT apply security restrictions
+    // Templates are developer-controlled, not user input
+    const result = evaluateExpression(template, variables, contextStack, {
+        securityLevel: 'none', // No security restrictions for templates
         allowLogicalOperators: true,
         allowMathOperators: true,
         allowComparisons: true,
         allowTernary: true,
         context: 'template-interpolation',
-        returnType: 'auto'
+        returnType: 'string'
     }, engine);
+    return String(result);
 }
+/**
+ * Safe condition evaluation for boolean contexts
+ * Maintains backward compatibility
+ */
 function evaluateSafeCondition(condition, variables, engine) {
     logger.debug(`Evaluating safe condition: ${condition} with variables: ${JSON.stringify(variables)}`);
-    return evaluateExpression(condition, variables, [], {
-        securityLevel: 'standard',
+    const result = evaluateExpression(condition, variables, [], {
+        securityLevel: 'basic',
         context: 'condition-evaluation',
         returnType: 'boolean',
         allowComparisons: true,
         allowLogicalOperators: true
     }, engine);
-}
-// Essential helper functions for the unified evaluator
-function isSimpleVariablePath(expression) {
-    logger.debug(`Checking if expression is a simple variable path: ${expression}`);
-    return /^[a-zA-Z_$][a-zA-Z0-9_$.]*$/.test(expression);
-}
-function resolveSimpleVariable(expression, variables, contextStack, engine) {
-    // Debug logging to track variable resolution issues
-    logger.debug(`Resolving variable '${expression}' - Available variables: ${JSON.stringify(Object.keys(variables || {}))}`);
-    // Try variables first
-    if (variables && Object.keys(variables).length > 0) {
-        const val = expression.split('.').reduce((obj, part) => obj?.[part], variables);
-        if (val !== undefined) {
-            logger.debug(`Variable '${expression}' resolved to: ${val}`);
-            return typeof val === 'object' ? JSON.stringify(val) : String(val);
-        }
-    }
-    // If not found in variables, check for engine session variables
-    if (engine) {
-        const sessionValue = resolveEngineSessionVariable(expression, engine);
-        if (sessionValue !== undefined) {
-            logger.debug(`Variable '${expression}' resolved from engine session: ${sessionValue}`);
-            return typeof sessionValue === 'object' ? JSON.stringify(sessionValue) : String(sessionValue);
-        }
-    }
-    logger.debug(`Variable '${expression}' not found in variables or engine session`);
-    return `[undefined: ${expression}]`;
-}
-// Helper function to resolve engine session variables
-function resolveEngineSessionVariable(expression, engine) {
-    try {
-        const currentFlowFrame = getCurrentFlowFrame(engine);
-        logger.debug(`Resolving engine session variable: ${expression} in flow frame: ${currentFlowFrame.flowName}`);
-        // Handle property access (e.g., cargo.someVar)
-        if (expression.includes('.')) {
-            const parts = expression.split('.');
-            const baseVariable = parts[0];
-            const propertyPath = parts.slice(1).join('.');
-            let baseValue;
-            // Get the base engine session variable
-            switch (baseVariable) {
-                case 'cargo':
-                    baseValue = engine.cargo || {};
-                    break;
-                case 'userInput':
-                case 'lastUserInput':
-                    const userEntries = currentFlowFrame.contextStack.filter(entry => entry.role === 'user');
-                    if (userEntries.length > 0) {
-                        const lastUserEntry = userEntries[userEntries.length - 1];
-                        baseValue = typeof lastUserEntry.content === 'string' ? lastUserEntry.content : String(lastUserEntry.content);
-                    }
-                    else {
-                        baseValue = undefined;
-                    }
-                    break;
-                case 'sessionId':
-                    baseValue = engine.sessionId;
-                    break;
-                case 'userId':
-                    baseValue = currentFlowFrame.userId;
-                    break;
-                case 'flowName':
-                    baseValue = currentFlowFrame.flowName;
-                    break;
-                default:
-                    logger.debug(`Unknown base engine session variable: ${baseVariable}`);
-                    return undefined;
-            }
-            // If base value is undefined, return undefined
-            if (baseValue === undefined || baseValue === null) {
-                logger.debug(`Base engine session variable '${baseVariable}' is undefined/null`);
-                return undefined;
-            }
-            // Navigate through the property path using getNestedValue
-            const result = getNestedValue(baseValue, propertyPath);
-            logger.debug(`Engine session variable '${expression}' resolved to:`, result);
-            return result;
-        }
-        // Handle direct variable access (no dots)
-        switch (expression) {
-            case 'cargo':
-                logger.debug(`Returning cargo from engine session variable: ${expression}`);
-                return engine.cargo || {};
-            case 'userInput':
-            case 'lastUserInput':
-                // Get the most recent user input from context stack
-                const userEntries = currentFlowFrame.contextStack.filter(entry => entry.role === 'user');
-                if (userEntries.length > 0) {
-                    logger.debug(`Returning last user input from engine session variable: ${expression}`);
-                    const lastUserEntry = userEntries[userEntries.length - 1];
-                    return typeof lastUserEntry.content === 'string' ? lastUserEntry.content : String(lastUserEntry.content);
-                }
-                logger.debug(`No user input found in context stack for engine session variable: ${expression}`);
-                return undefined;
-            case 'currentTime()':
-                logger.debug(`Returning current time for engine session variable: ${expression}`);
-                return new Date().toISOString();
-            case 'sessionId':
-                logger.debug(`Returning session ID for engine session variable: ${expression}`);
-                return engine.sessionId;
-            case 'userId':
-                logger.debug(`Returning user ID for engine session variable: ${expression}`);
-                return currentFlowFrame.userId;
-            case 'flowName':
-                logger.debug(`Returning flow name for engine session variable: ${expression}`);
-                return currentFlowFrame.flowName;
-            default:
-                logger.debug(`No specific engine session variable found for: ${expression}`);
-                return undefined;
-        }
-    }
-    catch (error) {
-        logger.debug(`Failed to resolve engine session variable '${expression}': ${error}`);
-        return undefined;
-    }
-}
-// Helper function to evaluate function calls
-function evaluateFunctionCall(expression, variables, contextStack, engine) {
-    try {
-        logger.debug(`Evaluating function call: ${expression}`);
-        // Handle currentTime() function call
-        if (expression === 'currentTime()') {
-            logger.debug(`Returning current time for function call: ${expression}`);
-            return new Date().toISOString();
-        }
-        // Handle safe standalone functions
-        const safeStandaloneFunctions = ['isNaN', 'parseInt', 'parseFloat', 'Boolean', 'Number', 'String'];
-        // Parse function call with arguments
-        const functionMatch = expression.match(/^(\w+)\((.*)\)$/);
-        if (functionMatch) {
-            const funcName = functionMatch[1];
-            const argsString = functionMatch[2];
-            if (safeStandaloneFunctions.includes(funcName)) {
-                logger.debug(`Evaluating safe standalone function: ${funcName}`);
-                // Parse and evaluate arguments
-                const args = [];
-                if (argsString.trim()) {
-                    // Simple argument parsing (supports literals and variables)
-                    const argParts = argsString.split(',').map(arg => arg.trim());
-                    for (const argPart of argParts) {
-                        let argValue;
-                        // Handle string literals
-                        if ((argPart.startsWith('"') && argPart.endsWith('"')) ||
-                            (argPart.startsWith("'") && argPart.endsWith("'"))) {
-                            argValue = argPart.slice(1, -1);
-                        }
-                        // Handle number literals
-                        else if (!isNaN(Number(argPart))) {
-                            argValue = Number(argPart);
-                        }
-                        // Handle boolean literals
-                        else if (argPart === 'true' || argPart === 'false') {
-                            argValue = argPart === 'true';
-                        }
-                        // Handle variables
-                        else {
-                            const varResult = resolveSimpleVariable(argPart, variables, contextStack, engine);
-                            if (varResult && !varResult.startsWith('[undefined:')) {
-                                argValue = varResult;
-                            }
-                            else if (engine) {
-                                const sessionResult = resolveEngineSessionVariable(argPart, engine);
-                                argValue = sessionResult !== undefined ? sessionResult : argPart;
-                            }
-                            else {
-                                argValue = argPart;
-                            }
-                        }
-                        args.push(argValue);
-                    }
-                }
-                // Execute the safe function
-                try {
-                    switch (funcName) {
-                        case 'isNaN':
-                            logger.debug(`Executing isNaN with args: ${args}`);
-                            return isNaN(args[0]);
-                        case 'parseInt':
-                            logger.debug(`Executing parseInt with args: ${args}`);
-                            return parseInt(args[0], args[1] || 10);
-                        case 'parseFloat':
-                            logger.debug(`Executing parseFloat with args: ${args}`);
-                            return parseFloat(args[0]);
-                        case 'Boolean':
-                            logger.debug(`Executing Boolean with args: ${args}`);
-                            return Boolean(args[0]);
-                        case 'Number':
-                            logger.debug(`Executing Number with args: ${args}`);
-                            return Number(args[0]);
-                        case 'String':
-                            logger.debug(`Executing String with args: ${args}`);
-                            return String(args[0]);
-                        default:
-                            logger.warn(`Safe function ${funcName} not implemented`);
-                            return undefined;
-                    }
-                }
-                catch (error) {
-                    logger.debug(`Error executing safe function ${funcName}: ${error.message}`);
-                    return undefined;
-                }
-            }
-        }
-        // Handle extractCryptoFromInput(...) function call
-        const extractCryptoMatch = expression.match(/^extractCryptoFromInput\((.+)\)$/);
-        if (extractCryptoMatch) {
-            const argExpression = extractCryptoMatch[1].trim();
-            // Evaluate the argument expression (could be a variable or literal)
-            let argValue;
-            if (argExpression.startsWith('"') && argExpression.endsWith('"')) {
-                argValue = argExpression.slice(1, -1);
-            }
-            else if (argExpression.startsWith("'") && argExpression.endsWith("'")) {
-                argValue = argExpression.slice(1, -1);
-            }
-            else {
-                // Try to resolve as variable (could be userInput or other variable)
-                const varResult = resolveSimpleVariable(argExpression, variables, contextStack, engine);
-                if (varResult && !varResult.startsWith('[undefined:')) {
-                    argValue = varResult;
-                }
-                else if (engine) {
-                    // Try engine session variables
-                    const sessionResult = resolveEngineSessionVariable(argExpression, engine);
-                    if (sessionResult !== undefined) {
-                        argValue = String(sessionResult);
-                    }
-                    else {
-                        argValue = argExpression; // Use as literal if can't resolve
-                    }
-                }
-                else {
-                    argValue = argExpression; // Use as literal if can't resolve
-                }
-            }
-            logger.debug(`extractCryptoFromInput called with: ${argValue}`);
-            // Extract crypto name from input text
-            const cryptoNames = {
-                'bitcoin': 'bitcoin',
-                'btc': 'bitcoin',
-                'ethereum': 'ethereum',
-                'eth': 'ethereum',
-                'litecoin': 'litecoin',
-                'ltc': 'litecoin',
-                'dogecoin': 'dogecoin',
-                'doge': 'dogecoin',
-                'cardano': 'cardano',
-                'ada': 'cardano'
-            };
-            const lowerInput = argValue.toLowerCase();
-            for (const [key, value] of Object.entries(cryptoNames)) {
-                if (lowerInput.includes(key)) {
-                    logger.debug(`Extracted crypto: ${value}`);
-                    return value;
-                }
-            }
-            logger.debug(`No crypto found in input, defaulting to bitcoin`);
-            return 'bitcoin'; // Default fallback
-        }
-        return undefined; // Function not recognized
-    }
-    catch (error) {
-        logger.warn(`Function call evaluation error: ${error.message}`);
-        return undefined;
-    }
-}
-function getNestedValue(obj, path) {
-    if (!obj || typeof path !== 'string') {
-        return undefined;
-    }
-    if (!path.includes('.')) {
-        return obj[path];
-    }
-    const keys = path.split('.');
-    let current = obj;
-    for (const key of keys) {
-        if (current === null || current === undefined) {
-            return undefined;
-        }
-        current = current[key];
-    }
-    return current;
-}
-function evaluateSafeOrExpression(expression, variables, contextStack, engine) {
-    const parts = expression.split('||').map(part => part.trim());
-    for (const part of parts) {
-        if ((part.startsWith('"') && part.endsWith('"')) ||
-            (part.startsWith("'") && part.endsWith("'"))) {
-            return part.slice(1, -1);
-        }
-        if (isSimpleVariablePath(part)) {
-            if (variables && Object.keys(variables).length > 0) {
-                const val = part.split('.').reduce((obj, partKey) => obj?.[partKey], variables);
-                if (val !== undefined && val !== null && String(val) !== '') {
-                    return typeof val === 'object' ? JSON.stringify(val) : String(val);
-                }
-            }
-            // Check engine session variables if not found in variables
-            if (engine) {
-                const sessionValue = resolveEngineSessionVariable(part, engine);
-                if (sessionValue !== undefined && sessionValue !== null && String(sessionValue) !== '') {
-                    return typeof sessionValue === 'object' ? JSON.stringify(sessionValue) : String(sessionValue);
-                }
-            }
-        }
-    }
-    const lastPart = parts[parts.length - 1];
-    if ((lastPart.startsWith('"') && lastPart.endsWith('"')) ||
-        (lastPart.startsWith("'") && lastPart.endsWith("'"))) {
-        return lastPart.slice(1, -1);
-    }
-    // Final fallback - check for session variables in the last part
-    if (engine && isSimpleVariablePath(lastPart)) {
-        const sessionValue = resolveEngineSessionVariable(lastPart, engine);
-        if (sessionValue !== undefined) {
-            return typeof sessionValue === 'object' ? JSON.stringify(sessionValue) : String(sessionValue);
-        }
-    }
-    return '';
-}
-function evaluateSafeTernaryExpression(expression, variables, contextStack, engine) {
-    const ternaryMatch = expression.match(/^([a-zA-Z_$.]+)\s*(===|!==|==|!=|>=|<=|>|<)\s*(\d+|'[^']*'|"[^"]*"|true|false)\s*\?\s*('([^']*)'|"([^"]*)"|[a-zA-Z_$.]+)\s*:\s*('([^']*)'|"([^"]*)"|[a-zA-Z_$.]+)$/);
-    if (!ternaryMatch) {
-        return `[invalid-ternary: ${expression}]`;
-    }
-    const [, leftVar, operator, rightValue, , trueStr1, trueStr2, , falseStr1, falseStr2] = ternaryMatch;
-    let leftVal;
-    if (variables && Object.keys(variables).length > 0) {
-        leftVal = leftVar.split('.').reduce((obj, part) => obj?.[part], variables);
-    }
-    // Check engine session variables if not found
-    if (leftVal === undefined && engine) {
-        leftVal = resolveEngineSessionVariable(leftVar, engine);
-    }
-    if (leftVal === undefined) {
-        return `[undefined: ${leftVar}]`;
-    }
-    let rightVal;
-    if (rightValue === 'true')
-        rightVal = true;
-    else if (rightValue === 'false')
-        rightVal = false;
-    else if (/^\d+$/.test(rightValue))
-        rightVal = parseInt(rightValue);
-    else if (/^\d*\.\d+$/.test(rightValue))
-        rightVal = parseFloat(rightValue);
-    else if (rightValue.startsWith("'") && rightValue.endsWith("'"))
-        rightVal = rightValue.slice(1, -1);
-    else if (rightValue.startsWith('"') && rightValue.endsWith('"'))
-        rightVal = rightValue.slice(1, -1);
-    else
-        rightVal = rightValue;
-    let condition = false;
-    switch (operator) {
-        case '===':
-            condition = leftVal === rightVal;
-            break;
-        case '!==':
-            condition = leftVal !== rightVal;
-            break;
-        case '==':
-            condition = leftVal == rightVal;
-            break;
-        case '!=':
-            condition = leftVal != rightVal;
-            break;
-        case '>':
-            condition = leftVal > rightVal;
-            break;
-        case '<':
-            condition = leftVal < rightVal;
-            break;
-        case '>=':
-            condition = leftVal >= rightVal;
-            break;
-        case '<=':
-            condition = leftVal <= rightVal;
-            break;
-        default: return `[invalid-operator: ${operator}]`;
-    }
-    if (condition) {
-        return trueStr1 || trueStr2 || resolveSimpleVariable(trueStr2, variables, contextStack, engine) || '';
-    }
-    else {
-        return falseStr1 || falseStr2 || resolveSimpleVariable(falseStr2, variables, contextStack, engine) || '';
-    }
-}
-function evaluateSafeMathematicalExpression(expression, variables, contextStack, engine) {
-    try {
-        let evaluatedExpression = expression;
-        const variablePattern = /[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*/g;
-        const variables_found = expression.match(variablePattern) || [];
-        for (const varPath of [...new Set(variables_found)]) {
-            if (/^\d+(\.\d+)?$/.test(varPath))
-                continue;
-            let value = resolveSimpleVariable(varPath, variables, contextStack, engine);
-            const numValue = Number(value);
-            if (!isNaN(numValue)) {
-                value = String(numValue);
-            }
-            else if (value === undefined || value === null) {
-                value = '0';
-            }
-            const regex = new RegExp(`\\b${varPath.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`, 'g');
-            evaluatedExpression = evaluatedExpression.replace(regex, String(value));
-        }
-        if (!/^[\d+\-*/%().\s]+$/.test(evaluatedExpression)) {
-            return `[unsafe-math: ${expression}]`;
-        }
-        const result = new Function(`"use strict"; return (${evaluatedExpression})`)();
-        return String(result);
-    }
-    catch (error) {
-        logger.warn(`Mathematical expression evaluation error: ${error.message}`);
-        return `[math-error: ${expression}]`;
-    }
+    return Boolean(result);
 }
 // === ENHANCED FLOW CONTROL COMMANDS ===
 // Universal commands that work during any flow
@@ -4727,7 +4429,7 @@ async function handlePendingInterruptionSwitch(engine, userId) {
         return getSystemMessage(engine, 'flow_switch_error', { targetFlow: 'unknown' });
     }
     // Clean up current flow
-    currentFlowFrame.transaction.fail("User confirmed flow switch");
+    TransactionManager.fail(currentFlowFrame.transaction, "User confirmed flow switch");
     popFromCurrentStack(engine);
     logger.info(`🔄 User confirmed switch from "${currentFlowName}" to "${targetFlow}"`);
     // Find and activate the target flow
@@ -4735,7 +4437,7 @@ async function handlePendingInterruptionSwitch(engine, userId) {
     if (!targetFlowDefinition) {
         return getSystemMessage(engine, 'flow_switch_error', { targetFlow });
     }
-    const newTransaction = new FlowTransaction(targetFlow, 'confirmed-switch', userId);
+    const newTransaction = TransactionManager.create(targetFlow, 'confirmed-switch', userId);
     const newFlowFrame = {
         flowName: targetFlow,
         flowId: targetFlowDefinition.id,
@@ -4781,7 +4483,7 @@ async function handleRegularFlowInterruption(intentAnalysis, engine, userId) {
         const flowsMenu = engine.flowsMenu; // Access the global flows menu
         logger.info(`🔄 Processing flow interruption: "${userInput}" -> ${targetFlow}`);
         // For non-financial flows, allow graceful switching with option to resume
-        currentFlowFrame.transaction.complete();
+        TransactionManager.complete(currentFlowFrame.transaction);
         // IMPORTANT: Clear pendingVariable from interrupted flow to avoid stale state when resuming
         if (currentFlowFrame.pendingVariable) {
             logger.info(`🧹 Clearing stale pendingVariable '${currentFlowFrame.pendingVariable}' from interrupted flow`);
@@ -4800,7 +4502,7 @@ async function handleRegularFlowInterruption(intentAnalysis, engine, userId) {
         // Activate the new flow
         const targetFlowDefinition = flowsMenu?.find(f => f.name === targetFlow);
         if (targetFlowDefinition) {
-            const newTransaction = new FlowTransaction(targetFlow, 'intent-switch', userId);
+            const newTransaction = TransactionManager.create(targetFlow, 'intent-switch', userId);
             const newFlowFrame = {
                 flowName: targetFlow,
                 flowId: targetFlowDefinition.id,
@@ -4848,9 +4550,14 @@ async function handleFlowExit(engine, userId, input) {
     // Clean up all flows with proper transaction logging
     const exitedFlows = [];
     let flow;
-    while ((flow = engine.flowStacks?.pop()?.[0])) {
+    while (engine.flowStacks.length > 0) {
+        const poppedStack = engine.flowStacks.pop();
+        if (!poppedStack || poppedStack.length === 0) {
+            break;
+        }
+        flow = poppedStack[0];
         logger.info(`Exiting flow: ${flow.flowName} due to user request`);
-        flow.transaction.fail(`User requested exit: ${input}`);
+        TransactionManager.fail(flow.transaction, `User requested exit: ${input}`);
         exitedFlows.push(flow.flowName);
         auditLogger.logFlowExit(flow.flowName, userId, flow.transaction.id, 'user_requested');
     }
@@ -4880,10 +4587,28 @@ async function processActivity(input, userId, engine) {
             if (flowControlResult) {
                 return flowControlResult;
             }
-            // Check for strong intent interruption (new flows)
-            const interruptionResult = await handleIntentInterruption(String(sanitizedInput), engine, userId);
-            if (interruptionResult) {
-                return interruptionResult;
+            // Check for strong intent interruption (new flows) - only if current flow AND all parent flows are interruptable
+            const flowStacks = engine.flowStacks;
+            const currentStackIndex = flowStacks.length - 1;
+            const currentStack = flowStacks[currentStackIndex] || [];
+            let isAnyFlowNonInterruptable = false;
+            for (const flowFrame of currentStack) {
+                const flowDefinition = engine.flowsMenu.find((f) => f.name === flowFrame.flowName);
+                const isFlowInterruptable = flowDefinition?.interruptable ?? false; // Default to false
+                if (!isFlowInterruptable) {
+                    isAnyFlowNonInterruptable = true;
+                    logger.debug(`Flow "${flowFrame.flowName}" in stack is not interruptable`);
+                    break;
+                }
+            }
+            if (!isAnyFlowNonInterruptable) {
+                const interruptionResult = await handleIntentInterruption(String(sanitizedInput), engine, userId);
+                if (interruptionResult) {
+                    return interruptionResult;
+                }
+            }
+            else {
+                logger.debug(`Skipping intent interruption check - one or more flows in the stack are not interruptable`);
             }
             // Clear the last SAY message if we had one
             if (currentFlowFrame.lastSayMessage) {
@@ -4905,7 +4630,7 @@ async function processActivity(input, userId, engine) {
                 // Clean up failed flow
                 if (getCurrentStackLength(engine) > 0) {
                     const failedFrame = popFromCurrentStack(engine);
-                    failedFrame.transaction.fail(error.message);
+                    TransactionManager.fail(failedFrame.transaction, error.message);
                 }
                 return `I encountered an error: ${error.message}. Please try again or contact support if the issue persists.`;
             }
@@ -4917,7 +4642,12 @@ async function processActivity(input, userId, engine) {
             if (activatedFlow) {
                 logger.info(`Flow activated: ${activatedFlow.name}`);
                 // Clear lastChatTurn since we now have flow context
-                engine.lastChatTurn = {};
+                const lastChatTurn = engine.lastChatTurn;
+                if (lastChatTurn) {
+                    // Clear the existing properties
+                    delete lastChatTurn.user;
+                    delete lastChatTurn.assistant;
+                }
                 logger.debug(`Cleared lastChatTurn - now using flow context for AI operations`);
                 const response = await playFlowFrame(engine);
                 logger.info(`Initial flow response: ${response}`);
@@ -4940,6 +4670,16 @@ async function processActivity(input, userId, engine) {
 }
 // === WORKFLOW ENGINE CLASS ===
 export class WorkflowEngine {
+    // Session-specific properties as getters - work directly with session data
+    get flowStacks() {
+        return this.sessionContext?.flowStacks || [[]];
+    }
+    get globalAccumulatedMessages() {
+        return this.sessionContext?.globalAccumulatedMessages || [];
+    }
+    get lastChatTurn() {
+        return this.sessionContext?.lastChatTurn || {};
+    }
     /**
      * Initialize a new EngineSessionContext for a user session.
      * If hostLogger is null, uses the global default logger.
@@ -4956,7 +4696,8 @@ export class WorkflowEngine {
     */
     constructor(hostLogger, aiCallback, flowsMenu, toolsRegistry, APPROVED_FUNCTIONS, globalVariables, // Optional global variables shared across all new flows
     validateOnInit, language, messageRegistry, guidanceConfig) {
-        this.lastChatTurn = {};
+        // Private session context - engine works directly with session data (no copying!)
+        this.sessionContext = null;
         hostLogger = hostLogger || logger; // Fallback to global fake logger if none provided
         logger = hostLogger; // Assign to global logger
         this.aiCallback = aiCallback;
@@ -4974,9 +4715,7 @@ export class WorkflowEngine {
             separator: '\n\n',
             contextSelector: 'auto'
         };
-        // Initialize flow stacks and global accumulated messages
-        this.flowStacks = [[]]; // Stack of flowFrames stacks for proper flow interruption/resumption
-        this.globalAccumulatedMessages = []; // Global SAY message accumulation across all stacks
+        // No longer initialize session-specific data in constructor - it's now in sessionContext
         this.sessionId = crypto.randomUUID();
         this.createdAt = new Date();
         this.lastActivity = new Date();
@@ -4999,117 +4738,190 @@ export class WorkflowEngine {
      *   const session = engine.initSession(yourLogger, 'user-123', 'session-456');
      */
     initSession(hostLogger, userId, sessionId) {
-        hostLogger = hostLogger || logger; // Fallback to global fake logger if none provided
         // Validate logger compatibility
-        const requiredMethods = ['info', 'warn', 'error', 'debug'];
-        for (const method of requiredMethods) {
-            if (typeof hostLogger[method] !== 'function') {
-                throw new Error(`Logger is missing required method: ${method}`);
+        if (hostLogger) {
+            const requiredMethods = ['info', 'warn', 'error', 'debug'];
+            for (const method of requiredMethods) {
+                if (typeof hostLogger[method] !== 'function') {
+                    throw new Error(`Logger is missing required method: ${method}`);
+                }
             }
         }
         // Assign the session logger to the global logger
         logger = hostLogger || logger;
         const engineSessionContext = {
-            hostLogger: hostLogger,
+            hostLogger: hostLogger || logger,
             sessionId: sessionId || crypto.randomUUID(),
             userId: userId,
             createdAt: new Date(),
             lastActivity: new Date(),
-            flowStacks: [[]],
+            flowStacks: [[]], // Initialize as array with one empty stack (pure data)
             globalAccumulatedMessages: [],
             lastChatTurn: {},
             globalVariables: this.globalVariables ? { ...this.globalVariables } : {},
-            cargo: {}
+            cargo: {},
+            response: null, // Initialize with no response
+            completedTransactions: [] // Initialize with no completed transactions
         };
         logger.info(`Engine session initialized: ${engineSessionContext.sessionId} for user: ${userId}`);
         return engineSessionContext;
     }
     async updateActivity(contextEntry, engineSessionContext) {
-        // Load session context if provided
-        if (engineSessionContext) {
-            logger = engineSessionContext.hostLogger;
+        try {
+            // Load session context if provided
+            let hostLogger = engineSessionContext.hostLogger || logger; // Fallback to global logger if not provided
+            if (engineSessionContext.hostLogger) {
+                const requiredMethods = ['info', 'warn', 'error', 'debug'];
+                for (const method of requiredMethods) {
+                    if (typeof engineSessionContext.hostLogger[method] !== 'function') {
+                        hostLogger = logger; // Fallback to global logger if hostLogger is missing methods
+                        break; // No need to throw error, just use global logger
+                        //throw new Error(`Logger is missing required method: ${method}`);
+                    }
+                }
+            }
+            logger = hostLogger; // Assign to global logger
             this.cargo = engineSessionContext.cargo;
+            logger.info(`Received Cargo: ${JSON.stringify(this.cargo)}`);
             this.sessionId = engineSessionContext.sessionId;
             this.createdAt = engineSessionContext.createdAt;
-            this.flowStacks = engineSessionContext.flowStacks;
-            this.globalAccumulatedMessages = engineSessionContext.globalAccumulatedMessages;
-            this.lastChatTurn = engineSessionContext.lastChatTurn;
-            this.globalVariables = engineSessionContext.globalVariables;
-        }
-        // Get userId from session context
-        const userId = engineSessionContext?.userId || 'anonymous';
-        this.lastActivity = new Date();
-        // Update session context with latest activity time
-        if (engineSessionContext) {
-            engineSessionContext.lastActivity = this.lastActivity;
-        }
-        // Role-based processing logic
-        if (contextEntry.role === 'user') {
-            // Detect intent to activate a flow or switch flows
-            const flowOrNull = await processActivity(String(contextEntry.content), userId, this);
-            // Store user turn in lastChatTurn if not in a flow
-            if (flowOrNull === null) {
-                this.lastChatTurn.user = contextEntry;
-            }
-            // Update session context with current state
+            // Store reference to session context - no copying needed! Engine works directly with session data
+            this.sessionContext = engineSessionContext;
+            // Ensure session context has proper initialization
+            if (!this.sessionContext.flowStacks || !Array.isArray(this.sessionContext.flowStacks)) {
+                this.sessionContext.flowStacks = [[]];
+                logger.warn('engineSessionContext.flowStacks was invalid, initialized fresh flowStacks');
+            }
+            if (!this.sessionContext.globalAccumulatedMessages) {
+                this.sessionContext.globalAccumulatedMessages = [];
+            }
+            if (!this.sessionContext.lastChatTurn) {
+                this.sessionContext.lastChatTurn = {};
+            }
+            if (!this.sessionContext.globalVariables) {
+                this.sessionContext.globalVariables = {};
+            }
+            // Safety check: ensure flowStacks is always properly initialized
+            if (this.sessionContext.flowStacks.length === 0) {
+                logger.warn('flowStacks was empty, adding initial stack...');
+                this.sessionContext.flowStacks.push([]); // Add empty stack
+            }
+            // Get userId from session context
+            const userId = engineSessionContext?.userId || 'anonymous';
+            this.lastActivity = new Date();
+            // Update session context with latest activity time
             if (engineSessionContext) {
-                engineSessionContext.flowStacks = this.flowStacks;
-                engineSessionContext.globalAccumulatedMessages = this.globalAccumulatedMessages;
-                engineSessionContext.lastChatTurn = this.lastChatTurn;
-                engineSessionContext.globalVariables = this.globalVariables || {};
+                engineSessionContext.lastActivity = this.lastActivity;
+            }
+            // Role-based processing logic
+            if (contextEntry.role === 'user') {
+                // Detect intent to activate a flow or switch flows
+                const responseOrNull = await processActivity(String(contextEntry.content), userId, this);
+                // Store user turn in lastChatTurn if not in a flow
+                if (responseOrNull === null) {
+                    this.sessionContext.lastChatTurn.user = contextEntry;
+                }
+                // No copying needed! Session context already contains the latest data
+                if (engineSessionContext) {
+                    engineSessionContext.response = responseOrNull; // Store the response from flow processing
+                    // Extract and store completed transactions for host access
+                    const newCompletedTransactions = [];
+                    for (const stack of this.flowStacks) {
+                        for (const frame of stack) {
+                            if (frame.transaction && (frame.transaction.state === 'completed' || frame.transaction.state === 'failed')) {
+                                newCompletedTransactions.push(frame.transaction);
+                            }
+                        }
+                    }
+                    if (!engineSessionContext.completedTransactions) {
+                        engineSessionContext.completedTransactions = [];
+                    }
+                    // Add any new completed transactions
+                    for (const transaction of newCompletedTransactions) {
+                        const existingTransaction = engineSessionContext.completedTransactions.find(t => t.id === transaction.id);
+                        if (!existingTransaction) {
+                            engineSessionContext.completedTransactions.push(transaction);
+                        }
+                    }
+                }
+                return engineSessionContext;
             }
-            return flowOrNull;
-        }
-        else if (contextEntry.role === 'assistant') {
-            // Check if we're in a flow or not
-            if (getCurrentStackLength(this) === 0) {
-                // Not in a flow - store in lastChatTurn for context
-                this.lastChatTurn.assistant = contextEntry;
+            else if (contextEntry.role === 'assistant') {
+                // Check if we're in a flow or not
+                if (getCurrentStackLength(this) === 0) {
+                    // Not in a flow - store in lastChatTurn for context
+                    this.sessionContext.lastChatTurn.assistant = contextEntry;
+                }
+                else {
+                    // In a flow - add to current flow's context stack
+                    const currentFlowFrame = getCurrentFlowFrame(this);
+                    addToContextStack(currentFlowFrame.contextStack, 'assistant', contextEntry.content, contextEntry.stepId, contextEntry.toolName, contextEntry.metadata);
+                }
+                // No copying needed! Session context already contains the latest data
+                if (engineSessionContext) {
+                    engineSessionContext.response = null; // No response for assistant turns
+                    // Extract and store completed transactions for host access
+                    const newCompletedTransactions = [];
+                    for (const stack of this.flowStacks) {
+                        for (const frame of stack) {
+                            if (frame.transaction && (frame.transaction.state === 'completed' || frame.transaction.state === 'failed')) {
+                                newCompletedTransactions.push(frame.transaction);
+                            }
+                        }
+                    }
+                    if (!engineSessionContext.completedTransactions) {
+                        engineSessionContext.completedTransactions = [];
+                    }
+                    // Add any new completed transactions
+                    for (const transaction of newCompletedTransactions) {
+                        const existingTransaction = engineSessionContext.completedTransactions.find(t => t.id === transaction.id);
+                        if (!existingTransaction) {
+                            engineSessionContext.completedTransactions.push(transaction);
+                        }
+                    }
+                }
+                return engineSessionContext;
             }
             else {
-                // In a flow - add to current flow's context stack
-                const currentFlowFrame = getCurrentFlowFrame(this);
-                addToContextStack(currentFlowFrame.contextStack, 'assistant', contextEntry.content, contextEntry.stepId, contextEntry.toolName, contextEntry.metadata);
+                // Throw error for unsupported roles
+                throw new Error(`Unsupported role '${contextEntry.role}' in updateActivity. Only 'user' and 'assistant' roles are supported.`);
+            }
+        }
+        catch (error) {
+            if (logger && logger.error) {
+                logger.error(`Error in updateActivity: ${error.message}`);
             }
-            // Update session context with current state
+            // Return session context with error information
             if (engineSessionContext) {
-                engineSessionContext.flowStacks = this.flowStacks;
-                engineSessionContext.globalAccumulatedMessages = this.globalAccumulatedMessages;
-                engineSessionContext.lastChatTurn = this.lastChatTurn;
-                engineSessionContext.globalVariables = this.globalVariables || {};
+                engineSessionContext.response = `Error: ${error.message}`;
+                return engineSessionContext;
             }
-            // Return null to indicate no flow processing needed
-            return null;
-        }
-        else {
-            // Throw error for unsupported roles
-            throw new Error(`Unsupported role '${contextEntry.role}' in updateActivity. Only 'user' and 'assistant' roles are supported.`);
+            // If no session context provided, we can't return it - this should not happen
+            throw error;
         }
     }
     // Add a SAY message to global accumulation
-    addAccumulatedMessage(message, engineSessionContext) {
-        // Load session context if provided
-        if (engineSessionContext) {
-            this.globalAccumulatedMessages = engineSessionContext.globalAccumulatedMessages;
+    addAccumulatedMessage(message) {
+        if (!this.sessionContext) {
+            logger.warn('No session context available for addAccumulatedMessage');
+            return;
         }
-        this.globalAccumulatedMessages.push(message);
-        // Update session context with new message
-        if (engineSessionContext) {
-            engineSessionContext.globalAccumulatedMessages = this.globalAccumulatedMessages;
+        if (!this.sessionContext.globalAccumulatedMessages) {
+            this.sessionContext.globalAccumulatedMessages = [];
         }
+        this.sessionContext.globalAccumulatedMessages.push(message);
     }
     // Get and clear all accumulated messages
-    getAndClearAccumulatedMessages(engineSessionContext) {
-        // Load session context if provided
-        if (engineSessionContext) {
-            this.globalAccumulatedMessages = engineSessionContext.globalAccumulatedMessages;
+    getAndClearAccumulatedMessages() {
+        if (!this.sessionContext) {
+            logger.warn('No session context available for getAndClearAccumulatedMessages');
+            return [];
         }
-        const messages = [...this.globalAccumulatedMessages];
-        this.globalAccumulatedMessages = [];
-        // Update session context with cleared messages
-        if (engineSessionContext) {
-            engineSessionContext.globalAccumulatedMessages = this.globalAccumulatedMessages;
+        if (!this.sessionContext.globalAccumulatedMessages) {
+            this.sessionContext.globalAccumulatedMessages = [];
         }
+        const messages = [...this.sessionContext.globalAccumulatedMessages];
+        this.sessionContext.globalAccumulatedMessages = [];
         return messages;
     }
     // Check if there are accumulated messages
@@ -5117,7 +4929,12 @@ export class WorkflowEngine {
         return this.globalAccumulatedMessages.length > 0;
     }
     initializeFlowStacks() {
-        initializeFlowStacks(this);
+        if (this.sessionContext) {
+            this.sessionContext.flowStacks = [[]];
+        }
+        else {
+            logger.warn('No session context available for initializeFlowStacks');
+        }
     }
     getCurrentStack() {
         return getCurrentStack(this);
@@ -5226,7 +5043,8 @@ export class WorkflowEngine {
             flowCallGraph: new Map(),
             currentDepth: 0,
             variableScopes: new Map(),
-            toolRegistry: new Set(this.toolsRegistry.map((t) => t.id))
+            toolRegistry: new Set(this.toolsRegistry.map((t) => t.id)),
+            flowCallStack: [] // Track parent flow chain for variable inheritance
         };
         try {
             this._validateFlowRecursive(flowName, validationState, opts);
@@ -5266,7 +5084,7 @@ export class WorkflowEngine {
             return;
         }
         // Find the flow definition
-        const flowDef = this.flowsMenu.find((f) => f.name === flowName);
+        const flowDef = this.flowsMenu.find((f) => f.id === flowName || f.name === flowName);
         if (!flowDef) {
             state.errors.push(`Flow not found: ${flowName}`);
             return;
@@ -5274,6 +5092,8 @@ export class WorkflowEngine {
         // Mark as visited
         state.visitedFlows.add(flowName);
         state.currentDepth++;
+        // Add to flow call stack for variable inheritance tracking
+        state.flowCallStack.push(flowName);
         // Initialize flow call graph
         if (!state.flowCallGraph.has(flowName)) {
             state.flowCallGraph.set(flowName, []);
@@ -5303,6 +5123,8 @@ export class WorkflowEngine {
                 this._validateFlowRecursive(calledFlow, state, opts);
             }
         }
+        // Remove from flow call stack when exiting this flow
+        state.flowCallStack.pop();
         state.currentDepth--;
     }
     /**
@@ -5692,7 +5514,7 @@ export class WorkflowEngine {
         // PHASE 2: Validate only top-level flows (not referenced as sub-flows)
         logger.info('🔍 Phase 2: Validating top-level flows...');
         for (const flow of this.flowsMenu) {
-            if (referencedSubFlows.has(flow.name)) {
+            if (referencedSubFlows.has(flow.name) || referencedSubFlows.has(flow.id)) {
                 // Skip validation of sub-flows - they'll be validated in parent context
                 logger.info(`⏭️  Skipping sub-flow "${flow.name}" - will be validated in parent context`);
                 results.skippedSubFlows.push(flow.name);
@@ -5741,11 +5563,24 @@ export class WorkflowEngine {
     // === ENHANCED VARIABLE SCOPE TRACKING ===
     /**
      * Gets the current variable scope available at a specific step
-     * This includes variables defined in flow definition + variables created by previous steps
+     * This includes variables defined in flow definition + variables created by previous steps + parent flow variables
      */
     _getCurrentStepScope(flowDef, stepIndex, state) {
         const scope = new Set();
-        // Add flow-defined variables
+        // Add parent flow variables (variable inheritance from call stack)
+        if (state.flowCallStack && state.flowCallStack.length > 0) {
+            // Iterate through parent flows in the call stack (excluding current flow)
+            for (let i = 0; i < state.flowCallStack.length - 1; i++) {
+                const parentFlowName = state.flowCallStack[i];
+                const parentFlowDef = this.flowsMenu.find((f) => f.id === parentFlowName || f.name === parentFlowName);
+                if (parentFlowDef && parentFlowDef.variables) {
+                    for (const varName of Object.keys(parentFlowDef.variables)) {
+                        scope.add(varName);
+                    }
+                }
+            }
+        }
+        // Add flow-defined variables (current flow)
         if (flowDef.variables) {
             for (const varName of Object.keys(flowDef.variables)) {
                 scope.add(varName);
@@ -5914,7 +5749,7 @@ export class WorkflowEngine {
                         const variableNames = extractVariableNames(varPath);
                         for (const rootVar of variableNames) {
                             // Check if it's a registered function first (global scope)
-                            const isApprovedFunction = this.APPROVED_FUNCTIONS && this.APPROVED_FUNCTIONS.get && this.APPROVED_FUNCTIONS.get(rootVar);
+                            const isApprovedFunction = this.APPROVED_FUNCTIONS && this.APPROVED_FUNCTIONS[rootVar];
                             // If not an approved function, check if it's in current scope as a variable
                             if (!isApprovedFunction && !currentScope.has(rootVar)) {
                                 state.errors.push(`${context} in step "${step.id}" references undefined variable: ${rootVar} (full path: ${varPath})`);