jsfe 0.9.0 → 0.9.1

package/dist/index.js

@@ -1214,6 +1214,7 @@ function evaluateCondition(data, condition) {
     if (!condition || typeof condition !== 'object')
         return false;
     const { field, operator, value } = condition;
+    logger.debug(`evaluateCondition called with field: ${field}, operator: ${operator}, value: ${value}`);
     try {
         let fieldValue = undefined;
         if (isPathTraversableObject(data)) {
@@ -1222,44 +1223,61 @@ function evaluateCondition(data, condition) {
         switch (operator) {
             case 'equals':
             case 'eq':
+                logger.debug(`evaluateCondition: checking equality for field ${field} with value ${value}`);
                 return fieldValue === value;
             case 'notEquals':
             case 'ne':
+                logger.debug(`evaluateCondition: checking inequality for field ${field} with value ${value}`);
                 return fieldValue !== value;
             case 'contains':
+                logger.debug(`evaluateCondition: checking containment for field ${field} with value ${value}`);
                 return String(fieldValue).includes(String(value));
             case 'exists':
+                logger.debug(`evaluateCondition: checking existence for field ${field}`);
                 return fieldValue !== null && fieldValue !== undefined;
             case 'notExists':
+                logger.debug(`evaluateCondition: checking non-existence for field ${field}`);
                 return fieldValue === null || fieldValue === undefined;
             case 'greaterThan':
             case 'gt':
+                logger.debug(`evaluateCondition: checking greaterThan for field ${field} with value ${value}`);
                 return Number(fieldValue) > Number(value);
             case 'lessThan':
             case 'lt':
+                logger.debug(`evaluateCondition: checking lessThan for field ${field} with value ${value}`);
                 return Number(fieldValue) < Number(value);
             case 'greaterThanOrEqual':
             case 'gte':
+                logger.debug(`evaluateCondition: checking greaterThanOrEqual for field ${field} with value ${value}`);
                 return Number(fieldValue) >= Number(value);
             case 'lessThanOrEqual':
             case 'lte':
+                logger.debug(`evaluateCondition: checking lessThanOrEqual for field ${field} with value ${value}`);
                 return Number(fieldValue) <= Number(value);
             case 'startsWith':
+                logger.debug(`evaluateCondition: checking startsWith for field ${field} with value ${value}`);
                 return String(fieldValue).startsWith(String(value));
             case 'endsWith':
+                logger.debug(`evaluateCondition: checking endsWith for field ${field} with value ${value}`);
                 return String(fieldValue).endsWith(String(value));
             case 'matches':
+                logger.debug(`evaluateCondition: checking regex match for field ${field} with value ${value}`);
                 return new RegExp(String(value)).test(String(fieldValue));
             case 'in':
+                logger.debug(`evaluateCondition: checking inclusion for field ${field} with value ${value}`);
                 return Array.isArray(value) && value.includes(fieldValue);
             case 'hasLength':
                 const length = Array.isArray(fieldValue) ? fieldValue.length : String(fieldValue).length;
+                logger.debug(`evaluateCondition: checking length for field ${field} with value ${value}, actual length: ${length}`);
                 return length === Number(value);
             case 'isArray':
+                logger.debug(`evaluateCondition: checking if field ${field} is an array`);
                 return Array.isArray(fieldValue);
             case 'isObject':
+                logger.debug(`evaluateCondition: checking if field ${field} is an object`);
                 return typeof fieldValue === 'object' && fieldValue !== null && !Array.isArray(fieldValue);
             case 'isString':
+                logger.debug(`evaluateCondition: checking if field ${field} is a string`);
                 return typeof fieldValue === 'string';
             case 'isNumber':
                 return typeof fieldValue === 'number' && !isNaN(fieldValue);
@@ -1284,14 +1302,19 @@ function interpolateObject(obj, data, args = {}, engine) {
                 let value = undefined;
                 if (isPathTraversableObject(data)) {
                     value = extractByPath(data, path);
+                    // Handle user input wrapper objects
+                    if (isUserInputVariable(value)) {
+                        value = value.value;
+                    }
                 }
-                // If not found in data and engine is available, check engine session variables
+                // If not found in data and engine is available, use the new unified resolver
                 if ((value === undefined || value === null)) {
                     try {
-                        value = resolveEngineSessionVariable(path, engine);
+                        // Use the new resolveVariablePath function which handles all variable types
+                        value = resolveVariablePath(path, args, [], engine);
                     }
                     catch (error) {
-                        // Ignore engine session variable resolution errors
+                        // Ignore variable resolution errors
                     }
                 }
                 return value !== undefined && value !== null ? value : '';
@@ -1306,14 +1329,19 @@ function interpolateObject(obj, data, args = {}, engine) {
                 let value = undefined;
                 if (isPathTraversableObject(data)) {
                     value = extractByPath(data, path.trim());
+                    // Handle user input wrapper objects
+                    if (isUserInputVariable(value)) {
+                        value = value.value;
+                    }
                 }
-                // If not found in data and engine is available, check engine session variables
+                // If not found in data and engine is available, use the new unified resolver
                 if ((value === undefined || value === null)) {
                     try {
-                        value = resolveEngineSessionVariable(path.trim(), engine);
+                        // Use the new resolveVariablePath function which handles all variable types
+                        value = resolveVariablePath(path.trim(), args, [], engine);
                     }
                     catch (error) {
-                        // Ignore engine session variable resolution errors
+                        // Ignore variable resolution errors
                     }
                 }
                 return value !== null && value !== undefined ? String(value) : '';
@@ -1501,11 +1529,8 @@ function checkRateLimit(engine, userId, toolId) {
 function sanitizeInput(input) {
     if (typeof input !== 'string')
         return input;
-    // Basic HTML escape and trim
-    return input.trim().replace(/[<>'"&]/g, (char) => {
-        const escapeMap = { '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#x27;', '&': '&amp;' };
-        return escapeMap[char];
-    });
+    // Simple trim - no HTML encoding since user input is treated as literal data
+    return input.trim();
 }
 function validateToolArgs(tool, args) {
     if (!tool.parameters)
@@ -1807,10 +1832,11 @@ async function playFlowFrame(engine) {
                 delete currentFlowFrame.pendingVariable;
             }
             else {
-                // Store user input as variable value
+                // Store user input as variable value with proper sanitization
                 // (System commands like 'cancel' are already handled before this point)
-                currentFlowFrame.variables[currentFlowFrame.pendingVariable] = userInput;
-                logger.info(`Stored user input in variable '${currentFlowFrame.pendingVariable}': "${userInput}"`);
+                setUserInputVariable(currentFlowFrame.variables, currentFlowFrame.pendingVariable, userInput, true // Sanitize user input
+                );
+                logger.info(`Stored sanitized user input in variable '${currentFlowFrame.pendingVariable}': "${userInput}"`);
                 delete currentFlowFrame.pendingVariable;
                 // Pop the SAY-GET step now that variable assignment is complete
                 currentFlowFrame.flowStepsStack.pop();
@@ -2124,7 +2150,7 @@ async function getFlowForInput(input, engine) {
 // === SMART DEFAULT ONFAIL GENERATOR ===
 function generateSmartRetryDefaultOnFail(step, error, currentFlowFrame) {
     const toolName = step.tool || 'unknown';
-    const errorMessage = error.message || 'Unknown error';
+    const errorMessage = error.message.toLocaleLowerCase() || 'unknown error';
     const flowName = currentFlowFrame.flowName;
     logger.info(`Generating smart default onFail for tool ${toolName}, in flow ${flowName} for error: ${errorMessage}`);
     // Categorize error types for intelligent handling
@@ -2152,7 +2178,8 @@ function generateSmartRetryDefaultOnFail(step, error, currentFlowFrame) {
         errorMessage.includes('bad request') ||
         errorMessage.includes('invalid request') ||
         errorMessage.includes('malformed request') ||
-        errorMessage.includes('syntax error');
+        errorMessage.includes('syntax error') ||
+        errorMessage.includes('rate limit');
     // Provoke cancelation of the current flow if unrecoverable
     const isAuthError = errorMessage.includes('401') || // Unauthorized
         errorMessage.includes('402') || // Payment Required
@@ -2178,7 +2205,7 @@ function generateSmartRetryDefaultOnFail(step, error, currentFlowFrame) {
         doCancel = true;
     }
     else {
-        logger.warn(`Unrecognized error type for tool ${toolName} in flow ${flowName}: ${errorMessage}`);
+        logger.debug(`Unrecognized error type for tool ${toolName} in flow ${flowName}: ${errorMessage}`);
         // Default to Cancel for unexpected errors
         doCancel = true;
     }
@@ -2304,7 +2331,7 @@ async function performStepInputValidation(step, currentFlowFrame, engine) {
     // Custom validation function
     if (step.inputValidation.customValidator && engine.APPROVED_FUNCTIONS) {
         try {
-            const validator = engine.APPROVED_FUNCTIONS.get(step.inputValidation.customValidator);
+            const validator = engine.APPROVED_FUNCTIONS[step.inputValidation.customValidator];
             if (typeof validator === 'function') {
                 const customResult = await validator(currentFlowFrame.variables, currentFlowFrame);
                 if (customResult && typeof customResult === 'object') {
@@ -2822,8 +2849,13 @@ function handleSetStep(currentFlowFrame, engine) {
         throw new Error(`SET step requires both 'variable' and 'value' attributes`);
     }
     // Support interpolation in SET values
+    // Use JavaScript evaluation context for security - strings will be properly quoted
     const interpolatedValue = typeof step.value === 'string'
-        ? interpolateMessage(step.value, [], currentFlowFrame?.variables, engine)
+        ? evaluateExpression(step.value, currentFlowFrame?.variables || {}, [], {
+            securityLevel: 'basic',
+            context: 'javascript-evaluation', // Force JavaScript context for SET values
+            returnType: 'auto'
+        }, engine)
         : step.value;
     if (currentFlowFrame && currentFlowFrame.variables !== undefined) {
         currentFlowFrame.variables[step.variable] = interpolatedValue;
@@ -2838,7 +2870,11 @@ async function handleSwitchStep(currentFlowFrame, engine) {
         throw new Error(`SWITCH step requires both 'variable' and 'branches' attributes`);
     }
     // Get the variable value to switch on
-    const switchValue = currentFlowFrame.variables ? currentFlowFrame.variables[step.variable] : undefined;
+    let switchValue = currentFlowFrame.variables ? currentFlowFrame.variables[step.variable] : undefined;
+    // Handle user input wrapper objects
+    if (isUserInputVariable(switchValue)) {
+        switchValue = switchValue.value;
+    }
     logger.info(`SWITCH step: evaluating variable '${step.variable}' with value '${switchValue}'`);
     // Find the matching branch (exact value matching only)
     let selectedStep = null;
@@ -2938,7 +2974,7 @@ async function handleSubFlowStep(currentFlowFrame, engine) {
         const input = currentFlowFrame.inputStack[currentFlowFrame.inputStack.length - 1];
         const flowsMenu = engine.flowsMenu; // Access the global flows menu
         const subFlowName = step.value || step.name || step.nextFlow;
-        const subFlow = flowsMenu?.find(f => f.name === subFlowName);
+        const subFlow = flowsMenu?.find(f => f.name === subFlowName || f.id === subFlowName);
         if (!subFlow) {
             return getSystemMessage(engine, 'subflow_not_found', { subFlowName });
         }
@@ -3212,6 +3248,11 @@ function generateEnhancedFallbackArgs(schema, input, flowFrame) {
             // Direct variable match
             if (flowFrame.variables[key] !== undefined) {
                 let value = flowFrame.variables[key];
+                // Handle user input wrapper objects
+                if (isUserInputVariable(value)) {
+                    const userInputObj = value;
+                    value = userInputObj.value;
+                }
                 // Type conversion if needed
                 if (prop.type === 'number' && typeof value === 'string') {
                     const num = parseFloat(value);
@@ -3222,37 +3263,6 @@ function generateEnhancedFallbackArgs(schema, input, flowFrame) {
                 args[key] = value;
                 continue;
             }
-            // Smart matching for account numbers
-            if (key.includes('account')) {
-                const accountVar = Object.keys(flowFrame.variables).find(varName => varName.includes('account') || (typeof flowFrame.variables[varName] === 'object' &&
-                    flowFrame.variables[varName] !== null &&
-                    flowFrame.variables[varName]?.accountId));
-                if (accountVar) {
-                    const accountData = flowFrame.variables[accountVar];
-                    if (typeof accountData === 'object' && accountData !== null && 'accountId' in accountData) {
-                        args[key] = accountData.accountId;
-                    }
-                    else if (typeof accountData === 'string') {
-                        args[key] = accountData;
-                    }
-                }
-            }
-            // Smart matching for amounts
-            if (key.includes('amount')) {
-                const amountVar = Object.keys(flowFrame.variables).find(varName => varName.includes('amount') || varName.includes('payment'));
-                if (amountVar) {
-                    const amountData = flowFrame.variables[amountVar];
-                    if (typeof amountData === 'number') {
-                        args[key] = amountData;
-                    }
-                    else if (typeof amountData === 'string') {
-                        const num = parseFloat(amountData);
-                        if (!isNaN(num)) {
-                            args[key] = num;
-                        }
-                    }
-                }
-            }
         }
     }
     // If enhanced fallback didn't find anything useful, try simple pattern matching
@@ -3315,7 +3325,7 @@ async function callTool(engine, tool, args, userId = 'anonymous', transactionId
             if (!APPROVED_FUNCTIONS) {
                 throw new Error(`Approved functions registry not available`);
             }
-            const fn = APPROVED_FUNCTIONS.get(tool.implementation.function);
+            const fn = APPROVED_FUNCTIONS[tool.implementation.function];
             if (!fn) {
                 throw new Error(`Function "${tool.implementation.function}" not found in approved functions registry`);
             }
@@ -3885,10 +3895,115 @@ export async function portableHash(data, secret, algorithm = 'SHA-256', encoding
         return encoding === 'base64' ? arrayBufferToBase64(hash) : Array.from(new Uint8Array(hash)).map(b => b.toString(16).padStart(2, '0')).join('');
     }
 }
-// Unified expression evaluator - replaces both evaluateSafeExpression and evaluateSafeCondition
+/**
+ * Resolve variable path like "cargo.callerId" or "user.profile.name"
+ * Supports variables, context stack, engine session variables, and global variables
+ */
+function resolveVariablePath(path, variables, contextStack, engine) {
+    const parts = path.split('.');
+    const rootVar = parts[0];
+    // 1. Try to find in flow variables first
+    let rootValue = variables[rootVar];
+    // Handle user input variables as pure literals
+    if (rootValue && typeof rootValue === 'object' && rootValue !== null) {
+        const userInputObj = rootValue;
+        if (userInputObj.__userInput === true && userInputObj.__literal === true) {
+            // Extract the literal value and treat it as a normal variable
+            // This allows normal property access like userInput.length
+            rootValue = userInputObj.value;
+        }
+        else {
+            logger.debug(`resolveVariablePath - Found user input object, but not a literal: ${JSON.stringify(userInputObj)}`);
+        }
+    }
+    // 2. If not found in variables, try context stack
+    if (rootValue === undefined && contextStack.length > 0) {
+        for (const context of contextStack) {
+            if (context && typeof context === 'object' && rootVar in context) {
+                rootValue = context[rootVar];
+                break;
+            }
+        }
+    }
+    // 3. If not found and engine available, try engine session variables
+    if (rootValue === undefined && engine) {
+        // Use the centralized session variable logic
+        const sessionVars = getEngineSessionVariables(engine, contextStack);
+        // Handle property access (e.g., cargo.someVar)
+        if (path.includes('.')) {
+            const parts = path.split('.');
+            const baseVariable = parts[0];
+            const propertyPath = parts.slice(1).join('.');
+            // Get the base session variable
+            const baseValue = sessionVars[baseVariable];
+            // If we found a base value, navigate the remaining path
+            if (baseValue !== undefined) {
+                return resolveVariablePath(propertyPath, { root: baseValue }, [], engine);
+            }
+        }
+        else {
+            // Handle direct variable access (no dots)
+            rootValue = sessionVars[path];
+        }
+    }
+    // 4. If not found and engine available, try global variables
+    if (rootValue === undefined && engine?.globalVariables) {
+        rootValue = engine.globalVariables[rootVar];
+    }
+    // If still not found, return undefined
+    if (rootValue === undefined) {
+        return undefined;
+    }
+    // Navigate the remaining path safely
+    let current = rootValue;
+    for (let i = 1; i < parts.length; i++) {
+        if (current === null || current === undefined) {
+            return undefined;
+        }
+        if (typeof current === 'object' && current !== null) {
+            current = current[parts[i]];
+        }
+        else {
+            return undefined;
+        }
+    }
+    return current;
+}
+/**
+ * Check if a variable value is marked as user input (literal data)
+ * User input should never be evaluated as code for security
+ */
+function isUserInputVariable(value) {
+    return (value !== null &&
+        typeof value === 'object' &&
+        value.__userInput === true &&
+        value.__literal === true);
+}
+/**
+ * Input sanitization for user-provided values
+ * Escapes special characters that could break expression syntax
+ * NOTE: This is secondary defense - primary security is treating user input as literal data
+ */
+function sanitizeUserInput(input) {
+    if (typeof input !== 'string') {
+        return String(input);
+    }
+    // Escape special characters that could break expression syntax
+    return input
+        .replace(/\\/g, '\\\\') // Escape backslashes
+        .replace(/'/g, "\\'") // Escape single quotes  
+        .replace(/"/g, '\\"') // Escape double quotes
+        .replace(/\n/g, '\\n') // Escape newlines
+        .replace(/\r/g, '\\r') // Escape carriage returns
+        .replace(/\t/g, '\\t'); // Escape tabs
+}
+/**
+ * Simplified Expression Evaluator
+ * Replaced complex two-phase parser with regex + JavaScript evaluation for 100% reliability
+ */
 function evaluateExpression(expression, variables = {}, contextStack = [], options = {}, engine) {
     const opts = {
-        securityLevel: 'standard',
+        securityLevel: 'basic',
         allowLogicalOperators: true,
         allowMathOperators: true,
         allowComparisons: true,
@@ -3898,335 +4013,56 @@ function evaluateExpression(expression, variables = {}, contextStack = [], optio
         ...options
     };
     try {
-        logger.debug(`Evaluating expression: ${expression} with options: ${JSON.stringify(opts)}`);
-        // Security check with configurable level
-        if (containsUnsafePatterns(expression, opts, engine)) {
-            logger.warn(`Blocked unsafe expression in ${opts.context}: ${expression}`);
-            return opts.returnType === 'boolean' ? false : `[blocked: ${expression}]`;
-        }
-        // Special handling for boolean return type with template expressions
-        // If the entire expression is wrapped in {{ }} and we want a boolean, 
-        // evaluate the inner expression directly without string conversion
-        if (opts.returnType === 'boolean' && expression.startsWith('{{') && expression.endsWith('}}')) {
-            const innerExpression = expression.slice(2, -2).trim();
-            const result = evaluateExpression(innerExpression, variables, contextStack, {
-                ...opts,
-                returnType: 'boolean'
-            }, engine);
-            return result;
-        }
-        // First, check if this is a comparison or logical expression with template variables
-        let processedExpression = expression;
-        // If it has template variables, interpolate them first (for non-boolean contexts)
-        while (processedExpression.includes('{{') && processedExpression.includes('}}')) {
-            processedExpression = interpolateTemplateVariables(processedExpression, variables, contextStack, opts, engine);
-        }
-        // Now check the processed expression for operators (after template interpolation)
-        // Handle logical AND/OR expressions (if allowed)
-        if (opts.allowLogicalOperators && (processedExpression.includes('&&') || processedExpression.includes('||'))) {
-            const result = evaluateLogicalExpression(processedExpression, variables, contextStack, opts, engine);
-            return convertReturnType(result, opts.returnType);
-        }
-        // Handle comparison expressions (if allowed)
-        if (opts.allowComparisons && containsComparisonOperators(processedExpression)) {
-            const result = evaluateComparisonExpression(processedExpression, variables, contextStack, opts, engine);
-            return convertReturnType(result, opts.returnType);
-        }
-        // Handle ternary expressions (if allowed)
-        if (opts.allowTernary && processedExpression.includes('?') && processedExpression.includes(':')) {
-            const result = evaluateSafeTernaryExpression(processedExpression, variables, contextStack, engine);
-            return convertReturnType(result, opts.returnType);
-        }
-        // Handle mathematical expressions (if allowed)
-        if (opts.allowMathOperators && isMathematicalExpression(processedExpression)) {
-            const result = evaluateSafeMathematicalExpression(processedExpression, variables, contextStack, engine);
-            return convertReturnType(result, opts.returnType);
-        }
-        // Handle typeof operator (e.g., "typeof variable", "typeof container")
-        if (processedExpression.trim().startsWith('typeof ')) {
-            const result = evaluateTypeofExpression(processedExpression, variables, contextStack, engine);
-            return convertReturnType(result, opts.returnType);
-        }
-        // Handle simple variable paths (e.g., "user.name", "data.items.length")
-        if (isSimpleVariablePath(processedExpression)) {
-            const result = resolveSimpleVariable(processedExpression, variables, contextStack, engine);
-            return convertReturnType(result, opts.returnType);
-        }
-        // Handle function calls (e.g., "currentTime()", "extractCryptoFromInput(...)")
-        if (processedExpression.includes('(') && processedExpression.includes(')')) {
-            const result = evaluateFunctionCall(processedExpression, variables, contextStack, engine);
-            if (result !== undefined) {
-                return convertReturnType(result, opts.returnType);
-            }
-        }
-        // If no pattern matches and we had template variables, return the interpolated result
-        if (processedExpression !== expression) {
-            return convertReturnType(processedExpression, opts.returnType);
-        }
-        // Fallback: treat as literal
-        const result = expression;
-        return convertReturnType(result, opts.returnType);
-    }
-    catch (error) {
-        logger.warn(`Expression evaluation error in ${opts.context}: ${error.message}`);
-        return opts.returnType === 'boolean' ? false : `[error: ${expression}]`;
-    }
-}
-// Unified security pattern checking with configurable levels
-function containsUnsafePatterns(expression, options, engine) {
-    const { securityLevel = 'standard', allowLogicalOperators = true, allowComparisons = true } = options;
-    // Safe string methods that are allowed in expressions
-    const safeStringMethods = [
-        'toLowerCase', 'toUpperCase', 'trim', 'charAt', 'charCodeAt', 'indexOf', 'lastIndexOf',
-        'substring', 'substr', 'slice', 'split', 'replace', 'match', 'search', 'includes',
-        'startsWith', 'endsWith', 'padStart', 'padEnd', 'repeat', 'toString', 'valueOf',
-        'length', 'concat', 'localeCompare', 'normalize'
-    ];
-    // Safe array methods that are allowed in expressions
-    const safeArrayMethods = [
-        'length', 'join', 'indexOf', 'lastIndexOf', 'includes', 'slice', 'toString', 'valueOf'
-    ];
-    // Safe math methods that are allowed in expressions
-    const safeMathMethods = [
-        'abs', 'ceil', 'floor', 'round', 'max', 'min', 'pow', 'sqrt', 'random'
-    ];
-    // Safe standalone functions that are allowed
-    const safeStandaloneFunctions = [
-        'isNaN', 'isFinite', 'parseInt', 'parseFloat',
-        'encodeURIComponent', 'decodeURIComponent', 'encodeURI', 'decodeURI',
-        'String', 'Number', 'Boolean' // Type conversion functions (not new constructors)
-    ];
-    // Check if expression contains only safe function calls
-    const functionCallPattern = /(\w+)\.(\w+)\s*\(/g;
-    const standaloneFunctionPattern = /(?:^|[^.\w])(\w+)\s*\(/g;
-    let match;
-    const foundFunctionCalls = [];
-    // First, check for any standalone function calls (not methods)
-    standaloneFunctionPattern.lastIndex = 0; // Reset regex
-    while ((match = standaloneFunctionPattern.exec(expression)) !== null) {
-        const functionName = match[1];
-        // Skip if this is actually a method call (preceded by a dot)
-        const beforeFunction = expression.substring(0, match.index + match[0].indexOf(functionName));
-        if (!beforeFunction.endsWith('.')) {
-            // Check if this standalone function is in our safe list or approved functions
-            const isApprovedFunction = engine.APPROVED_FUNCTIONS?.get &&
-                typeof engine.APPROVED_FUNCTIONS.get(functionName) === 'function';
-            if (!safeStandaloneFunctions.includes(functionName) && !isApprovedFunction) {
-                logger.debug(`Blocking unsafe standalone function call: ${functionName}`);
-                return true; // Unsafe standalone function calls are not allowed
-            }
-            logger.debug(`Allowing safe standalone function call: ${functionName}${isApprovedFunction ? ' (approved)' : ' (built-in)'}`);
-        }
-    }
-    // Then, check method calls and verify they're safe
-    functionCallPattern.lastIndex = 0; // Reset regex
-    while ((match = functionCallPattern.exec(expression)) !== null) {
-        const methodName = match[2];
-        foundFunctionCalls.push(methodName);
-        // If this method is not in our safe lists, it's potentially unsafe
-        if (!safeStringMethods.includes(methodName) &&
-            !safeArrayMethods.includes(methodName) &&
-            !safeMathMethods.includes(methodName)) {
-            logger.debug(`Blocking unsafe method call: ${methodName}`);
-            return true; // Unsafe method found
-        }
-    }
-    // Core dangerous patterns (blocked at all levels) - removed the problematic function call pattern
-    const coreDangerousPatterns = [
-        /eval\s*\(/, // eval() calls
-        /Function\s*\(/, // Function constructor
-        /constructor/, // Constructor access
-        /prototype/, // Prototype manipulation  
-        /__proto__/, // Prototype access
-        /import\s*\(/, // Dynamic imports
-        /require\s*\(/, // CommonJS requires
-        /process\./, // Process access
-        /global\./, // Global access
-        /window\./, // Window access (browser)
-        /document\./, // Document access (browser)
-        /console\./, // Console access
-        /setTimeout/, // Timer functions
-        /setInterval/, // Timer functions
-        /fetch\s*\(/, // Network requests
-        /XMLHttpRequest/, // Network requests
-        /localStorage/, // Storage access
-        /sessionStorage/, // Storage access
-        /\+\s*\+/, // Increment operators
-        /--/, // Decrement operators
-        /(?<![=!<>])=(?!=)/, // Assignment operators = (but not ==, !=, <=, >=)
-        /delete\s+/, // Delete operator
-        /new\s+/, // Constructor calls
-        /throw\s+/, // Throw statements
-        /try\s*\{/, // Try blocks
-        /catch\s*\(/, // Catch blocks
-        /finally\s*\{/, // Finally blocks
-        /for\s*\(/, // For loops
-        /while\s*\(/, // While loops
-        /do\s*\{/, // Do-while loops
-        /switch\s*\(/, // Switch statements
-        /return\s+/, // Return statements
-    ];
-    // Additional strict patterns (only blocked in strict mode)
-    const strictOnlyPatterns = [
-        /\[.*\]/, // Array/object bracket notation
-        /this\./, // This access
-        /arguments\./, // Arguments access
-    ];
-    // Check core patterns (function call validation is handled separately above)
-    if (coreDangerousPatterns.some(pattern => pattern.test(expression))) {
-        return true;
-    }
-    // Check strict-only patterns if in strict mode
-    if (securityLevel === 'strict' && strictOnlyPatterns.some(pattern => pattern.test(expression))) {
-        return true;
-    }
-    return false;
-}
-// Template variable interpolation ({{variable}} format) with nested support
-// Inside-out approach: process innermost {{}} expressions first, then repeat until no more changes
-function interpolateTemplateVariables(template, variables, contextStack, options, engine) {
-    logger.debug(`Starting template interpolation: ${template}`);
-    let result = template;
-    let iterations = 0;
-    const maxIterations = 10; // Prevent infinite loops
-    while (result.includes('{{') && result.includes('}}') && iterations < maxIterations) {
-        iterations++;
-        logger.debug(`Template interpolation iteration ${iterations}: ${result}`);
-        // Find the LAST (rightmost) {{ - this is the innermost opening
-        const lastOpenIndex = result.lastIndexOf('{{');
-        if (lastOpenIndex === -1)
-            break;
-        // From that position, find the FIRST }} - this is the matching closing
-        const closeIndex = result.indexOf('}}', lastOpenIndex);
-        if (closeIndex === -1) {
-            logger.error(`Found {{ at ${lastOpenIndex} but no matching }} in: ${result}`);
-            return 'Invalid template!';
-        }
-        // Extract the innermost expression
-        const expression = result.substring(lastOpenIndex + 2, closeIndex).trim();
-        logger.debug(`Found innermost template expression: {{${expression}}}`);
-        // Evaluate the innermost expression
-        const evaluatedContent = evaluateExpression(expression, variables, contextStack, {
-            ...options,
-            returnType: 'string'
-        }, engine);
-        const replacement = typeof evaluatedContent === 'string' ? evaluatedContent : String(evaluatedContent);
-        logger.debug(`Evaluated to: ${replacement}`);
-        // Replace the template expression with its evaluated result
-        result = result.substring(0, lastOpenIndex) + replacement + result.substring(closeIndex + 2);
-        logger.debug(`After replacement: ${result}`);
-    }
-    if (iterations >= maxIterations) {
-        logger.warn(`Template interpolation stopped after ${maxIterations} iterations to prevent infinite loop`);
-    }
-    logger.debug(`Final template result: ${result}`);
-    return result;
-}
-// Logical expression evaluator (&&, ||)
-function evaluateLogicalExpression(expression, variables, contextStack, options, engine) {
-    // Handle OR expressions
-    if (expression.includes('||')) {
-        return evaluateSafeOrExpression(expression, variables, contextStack, engine);
-    }
-    // Handle AND expressions
-    if (expression.includes('&&')) {
-        const parts = expression.split('&&').map(part => part.trim());
-        for (const part of parts) {
-            const partResult = evaluateExpression(part, variables, contextStack, {
-                ...options,
-                returnType: 'boolean'
-            }, engine);
-            if (!partResult) {
-                return false;
+        logger.debug(`Simplified evaluation starting: ${expression}`);
+        // If not a string, return as-is
+        if (typeof expression !== 'string') {
+            return expression;
+        }
+        // Simple regex to find {{expression}} patterns
+        const expressionRegex = /\{\{([^}]+)\}\}/g;
+        // Create evaluation context by merging all available variables
+        const context = createSimplifiedEvaluationContext(variables, contextStack, engine);
+        // Check if the entire expression is a single interpolation
+        const singleExpressionMatch = expression.match(/^\{\{([^}]+)\}\}$/);
+        if (singleExpressionMatch) {
+            // Single expression - return the evaluated result directly to preserve type
+            try {
+                const evaluationResult = evaluateJavaScriptExpression(singleExpressionMatch[1].trim(), context);
+                logger.debug(`Simplified evaluation complete (single): ${expression} -> ${evaluationResult}`);
+                return convertReturnType(evaluationResult, opts.returnType);
+            }
+            catch (error) {
+                const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+                logger.warn(`Single expression evaluation failed: ${singleExpressionMatch[1]} - ${errorMessage}`);
+                return opts.returnType === 'boolean' ? false : `[error: ${expression}]`;
             }
         }
-        return true;
-    }
-    return false;
-}
-// Comparison expression evaluator (==, !=, <, >, <=, >=)
-function evaluateComparisonExpression(expression, variables, contextStack, options, engine) {
-    // For comparison expressions, we need to handle variable substitution properly
-    let processedExpression = expression;
-    // Find all variable references (not in template format) and replace them
-    // This handles cases like "input.toLowerCase()" where input is a variable
-    const variableNames = Object.keys(variables);
-    for (const varName of variableNames) {
-        const varValue = variables[varName];
-        // Create a regex to match the variable name as a whole word
-        const varRegex = new RegExp(`\\b${varName}\\b`, 'g');
-        // Replace variable references with their values, properly quoted for strings
-        processedExpression = processedExpression.replace(varRegex, (match) => {
-            if (typeof varValue === 'string') {
-                logger.debug(`Replacing variable '${varName}' with string value: ${varValue}`);
-                return `"${varValue}"`;
-            }
-            else if (typeof varValue === 'boolean' || typeof varValue === 'number') {
-                logger.debug(`Replacing variable '${varName}' with value: ${varValue}`);
-                return varValue.toString();
-            }
-            else if (varValue === null || varValue === undefined) {
-                logger.debug(`Replacing variable '${varName}' with null value`);
-                return 'null';
+        // Multiple expressions or mixed content - convert to string
+        const result = expression.replace(expressionRegex, (match, expr) => {
+            try {
+                // Direct JavaScript evaluation with injected variables
+                const evaluationResult = evaluateJavaScriptExpression(expr.trim(), context);
+                return String(evaluationResult);
             }
-            else {
-                logger.debug(`Replacing variable '${varName}' with JSON value:`, varValue);
-                return JSON.stringify(varValue);
+            catch (error) {
+                const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+                logger.warn(`Expression evaluation failed: ${expr} - ${errorMessage}`);
+                return match; // Return original if evaluation fails
             }
         });
-    }
-    // Handle any remaining {{variable}} template expressions
-    const variableMatches = processedExpression.match(/\{\{([^}]+)\}\}/g);
-    if (variableMatches) {
-        for (const match of variableMatches) {
-            const varName = match.slice(2, -2).trim();
-            let varValue = getNestedValue(variables, varName);
-            logger.debug(`Resolving template variable '${varName}' with value:`, varValue);
-            // Check engine session variables if not found
-            if (varValue === undefined && engine) {
-                varValue = resolveEngineSessionVariable(varName, engine);
-            }
-            // Convert value to appropriate type for comparison
-            let replacementValue;
-            if (varValue === undefined || varValue === null) {
-                replacementValue = 'null';
-            }
-            else if (typeof varValue === 'string') {
-                replacementValue = `"${varValue}"`;
-            }
-            else if (typeof varValue === 'boolean') {
-                replacementValue = varValue.toString();
-            }
-            else {
-                replacementValue = varValue.toString();
-            }
-            processedExpression = processedExpression.replace(match, replacementValue);
-        }
-    }
-    logger.debug(`Comparison expression after variable substitution: ${processedExpression}`);
-    try {
-        // Use Function constructor for safe evaluation
-        const result = new Function('return ' + processedExpression)();
-        logger.debug(`Comparison evaluation result: ${result}`);
-        return !!result; // Convert to boolean
+        logger.debug(`Simplified evaluation complete: ${expression} -> ${result}`);
+        return convertReturnType(result, opts.returnType);
     }
     catch (error) {
-        logger.info(`Comparison evaluation failed for '${expression}':`, error.message);
-        return false;
+        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+        logger.warn(`Simplified evaluation error: ${errorMessage}`);
+        return opts.returnType === 'boolean' ? false : `[error: ${expression}]`;
     }
 }
-// Helper function to check for comparison operators
-function containsComparisonOperators(expression) {
-    return /[<>=!]+/.test(expression) &&
-        !(expression.includes('&&') || expression.includes('||')); // Not a logical expression
-}
-// Helper function to check for mathematical expressions
-function isMathematicalExpression(expression) {
-    return /[\+\-\*\/\%]/.test(expression) &&
-        !expression.includes('++') &&
-        !expression.includes('--'); // Exclude increment/decrement
-}
-// Convert result to requested return type
+/**
+ * Convert result to requested return type
+ * Enhanced version with better type handling
+ */
 function convertReturnType(value, returnType) {
     switch (returnType) {
         case 'boolean':
@@ -4238,478 +4074,158 @@ function convertReturnType(value, returnType) {
             return value;
     }
 }
-// Clean unified expression interface functions  
+/**
+ * Get engine session variables for simplified evaluator
+ * This is the SINGLE SOURCE OF TRUTH for session variable logic
+ */
+function getEngineSessionVariables(engine, contextStack) {
+    const sessionVars = {};
+    try {
+        const currentFlowFrame = getCurrentFlowFrame(engine);
+        // Get userInput from the most recent user entry in context stack
+        const userEntries = currentFlowFrame.contextStack.filter(entry => entry.role === 'user');
+        if (userEntries.length > 0) {
+            const lastUserEntry = userEntries[userEntries.length - 1];
+            const userInputValue = typeof lastUserEntry.content === 'string' ? lastUserEntry.content : String(lastUserEntry.content);
+            sessionVars.userInput = userInputValue;
+            sessionVars.lastUserInput = userInputValue; // alias
+        }
+        // Add other engine session variables
+        sessionVars.cargo = engine.cargo || {};
+        sessionVars.sessionId = engine.sessionId;
+        sessionVars.userId = currentFlowFrame.userId;
+        sessionVars.flowName = currentFlowFrame.flowName;
+        // Special function-like variables
+        sessionVars['currentTime()'] = new Date().toISOString();
+        // Add global variables if available
+        if (engine.globalVariables) {
+            Object.assign(sessionVars, engine.globalVariables);
+        }
+    }
+    catch (error) {
+        logger.debug(`Error getting engine session variables: ${error}`);
+    }
+    return sessionVars;
+}
+/**
+ * Create evaluation context with all available variables for simplified evaluator
+ */
+function createSimplifiedEvaluationContext(variables, contextStack, engine) {
+    // Just use the provided variables - contextStack is primarily for conversation history
+    const allVars = variables || {};
+    // Get engine session variables
+    const engineSessionVars = getEngineSessionVariables(engine, contextStack);
+    const context = {
+        // All variables as top-level properties
+        ...allVars,
+        // Engine session variables (userInput, cargo, sessionId, etc.)
+        ...engineSessionVars,
+        // Special variables that should always be available
+        $args: variables?.$args || {},
+        xml_result: variables?.xml_result,
+        json_result: variables?.json_result,
+        // Add context object for Object.keys() patterns (avoid 'this' keyword issues)
+        currentContext: { ...allVars, ...engineSessionVars },
+        // Include approved functions so they can be called in expressions
+        ...engine.APPROVED_FUNCTIONS,
+        // Utility objects available in expressions
+        Object,
+        Date,
+        Math,
+        String,
+        Number,
+        Boolean,
+        Array,
+        JSON
+    };
+    return context;
+}
+/**
+ * Safely evaluate JavaScript expression with injected context
+ */
+function evaluateJavaScriptExpression(expression, context) {
+    // Filter to only valid JavaScript identifiers (root variables only)
+    const validParamNames = Object.keys(context).filter(key => /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(key));
+    // Unwrap user input variables before passing to function
+    const paramValues = validParamNames.map(name => {
+        const value = context[name];
+        // Unwrap user input wrapper objects
+        if (value && typeof value === 'object' &&
+            value.__userInput === true &&
+            value.__literal === true) {
+            return value.value;
+        }
+        return value;
+    });
+    // Build function body that evaluates the expression
+    const functionBody = `
+    "use strict";
+    try {
+      const result = (${expression});
+      // Auto-stringify complex data structures when used in string contexts
+      if (typeof result === 'object' && result !== null &&
+          !(result.__userInput === true && result.__literal === true)) {
+        return JSON.stringify(result);
+      }
+      return result;
+    } catch (e) {
+      throw new Error('Expression evaluation failed: ' + e.message);
+    }
+  `;
+    // Create and execute function with only valid parameter names
+    const evaluatorFunction = new Function(...validParamNames, functionBody);
+    return evaluatorFunction(...paramValues);
+}
+/**
+ * Security-aware variable setter for user input
+ * Integrates with the variable resolution system
+ */
+function setUserInputVariable(variables, key, value, sanitize = true) {
+    // Mark user input as static literal data that should never be evaluated as code
+    variables[key] = {
+        __userInput: true,
+        __literal: true,
+        value: sanitize && typeof value === 'string' ? sanitizeUserInput(value) : value
+    };
+}
+// ===============================================
+// LEGACY COMPATIBILITY FUNCTIONS
+// ===============================================
+/**
+ * Clean unified expression interface functions
+ * Maintains backward compatibility with existing code
+ */
 function interpolateMessage(template, contextStack, variables = {}, engine) {
     logger.debug(`Interpolating message template: ${template} with variables: ${JSON.stringify(variables)}`);
     if (!template)
         return template;
-    // Use our enhanced template interpolation that supports nested {{ }} expressions
-    return interpolateTemplateVariables(template, variables, contextStack, {
-        securityLevel: 'standard',
+    // For template interpolation, we should NOT apply security restrictions
+    // Templates are developer-controlled, not user input
+    const result = evaluateExpression(template, variables, contextStack, {
+        securityLevel: 'none', // No security restrictions for templates
         allowLogicalOperators: true,
         allowMathOperators: true,
         allowComparisons: true,
         allowTernary: true,
         context: 'template-interpolation',
-        returnType: 'auto'
+        returnType: 'string'
     }, engine);
+    return String(result);
 }
+/**
+ * Safe condition evaluation for boolean contexts
+ * Maintains backward compatibility
+ */
 function evaluateSafeCondition(condition, variables, engine) {
     logger.debug(`Evaluating safe condition: ${condition} with variables: ${JSON.stringify(variables)}`);
-    return evaluateExpression(condition, variables, [], {
-        securityLevel: 'standard',
+    const result = evaluateExpression(condition, variables, [], {
+        securityLevel: 'basic',
         context: 'condition-evaluation',
         returnType: 'boolean',
         allowComparisons: true,
         allowLogicalOperators: true
     }, engine);
-}
-// Essential helper functions for the unified evaluator
-function isSimpleVariablePath(expression) {
-    logger.debug(`Checking if expression is a simple variable path: ${expression}`);
-    return /^[a-zA-Z_$][a-zA-Z0-9_$.]*$/.test(expression);
-}
-function resolveSimpleVariable(expression, variables, contextStack, engine) {
-    // Debug logging to track variable resolution issues
-    logger.debug(`Resolving variable '${expression}' - Available variables: ${JSON.stringify(Object.keys(variables || {}))}`);
-    // Try variables first
-    if (variables && Object.keys(variables).length > 0) {
-        const val = expression.split('.').reduce((obj, part) => obj?.[part], variables);
-        if (val !== undefined) {
-            logger.debug(`Variable '${expression}' resolved to: ${val}`);
-            return typeof val === 'object' ? JSON.stringify(val) : String(val);
-        }
-    }
-    // If not found in variables, check for engine session variables
-    if (engine) {
-        const sessionValue = resolveEngineSessionVariable(expression, engine);
-        if (sessionValue !== undefined) {
-            logger.debug(`Variable '${expression}' resolved from engine session: ${sessionValue}`);
-            return typeof sessionValue === 'object' ? JSON.stringify(sessionValue) : String(sessionValue);
-        }
-    }
-    logger.debug(`Variable '${expression}' not found in variables or engine session`);
-    return `[undefined: ${expression}]`;
-}
-// Helper function to resolve engine session variables
-function resolveEngineSessionVariable(expression, engine) {
-    try {
-        const currentFlowFrame = getCurrentFlowFrame(engine);
-        logger.debug(`Resolving engine session variable: ${expression} in flow frame: ${currentFlowFrame.flowName}`);
-        // Handle property access (e.g., cargo.someVar)
-        if (expression.includes('.')) {
-            const parts = expression.split('.');
-            const baseVariable = parts[0];
-            const propertyPath = parts.slice(1).join('.');
-            let baseValue;
-            // Get the base engine session variable
-            switch (baseVariable) {
-                case 'cargo':
-                    baseValue = engine.cargo || {};
-                    break;
-                case 'userInput':
-                case 'lastUserInput':
-                    const userEntries = currentFlowFrame.contextStack.filter(entry => entry.role === 'user');
-                    if (userEntries.length > 0) {
-                        const lastUserEntry = userEntries[userEntries.length - 1];
-                        baseValue = typeof lastUserEntry.content === 'string' ? lastUserEntry.content : String(lastUserEntry.content);
-                    }
-                    else {
-                        baseValue = undefined;
-                    }
-                    break;
-                case 'sessionId':
-                    baseValue = engine.sessionId;
-                    break;
-                case 'userId':
-                    baseValue = currentFlowFrame.userId;
-                    break;
-                case 'flowName':
-                    baseValue = currentFlowFrame.flowName;
-                    break;
-                default:
-                    logger.debug(`Unknown base engine session variable: ${baseVariable}`);
-                    return undefined;
-            }
-            // If base value is undefined, return undefined
-            if (baseValue === undefined || baseValue === null) {
-                logger.debug(`Base engine session variable '${baseVariable}' is undefined/null`);
-                return undefined;
-            }
-            // Navigate through the property path using getNestedValue
-            const result = getNestedValue(baseValue, propertyPath);
-            logger.debug(`Engine session variable '${expression}' resolved to:`, result);
-            return result;
-        }
-        // Handle direct variable access (no dots)
-        switch (expression) {
-            case 'cargo':
-                logger.debug(`Returning cargo from engine session variable: ${expression}`);
-                return engine.cargo || {};
-            case 'userInput':
-            case 'lastUserInput':
-                // Get the most recent user input from context stack
-                const userEntries = currentFlowFrame.contextStack.filter(entry => entry.role === 'user');
-                if (userEntries.length > 0) {
-                    logger.debug(`Returning last user input from engine session variable: ${expression}`);
-                    const lastUserEntry = userEntries[userEntries.length - 1];
-                    return typeof lastUserEntry.content === 'string' ? lastUserEntry.content : String(lastUserEntry.content);
-                }
-                logger.debug(`No user input found in context stack for engine session variable: ${expression}`);
-                return undefined;
-            case 'currentTime()':
-                logger.debug(`Returning current time for engine session variable: ${expression}`);
-                return new Date().toISOString();
-            case 'sessionId':
-                logger.debug(`Returning session ID for engine session variable: ${expression}`);
-                return engine.sessionId;
-            case 'userId':
-                logger.debug(`Returning user ID for engine session variable: ${expression}`);
-                return currentFlowFrame.userId;
-            case 'flowName':
-                logger.debug(`Returning flow name for engine session variable: ${expression}`);
-                return currentFlowFrame.flowName;
-            default:
-                logger.debug(`No specific engine session variable found for: ${expression}`);
-                return undefined;
-        }
-    }
-    catch (error) {
-        logger.debug(`Failed to resolve engine session variable '${expression}': ${error}`);
-        return undefined;
-    }
-}
-// Helper function to evaluate function calls
-function evaluateFunctionCall(expression, variables, contextStack, engine) {
-    try {
-        logger.debug(`Evaluating function call: ${expression}`);
-        // Handle currentTime() function call
-        if (expression === 'currentTime()') {
-            logger.debug(`Returning current time for function call: ${expression}`);
-            return new Date().toISOString();
-        }
-        // Handle safe standalone functions
-        const safeStandaloneFunctions = ['isNaN', 'parseInt', 'parseFloat', 'Boolean', 'Number', 'String'];
-        // Parse function call with arguments
-        const functionMatch = expression.match(/^(\w+)\((.*)\)$/);
-        if (functionMatch) {
-            const funcName = functionMatch[1];
-            const argsString = functionMatch[2];
-            if (safeStandaloneFunctions.includes(funcName)) {
-                logger.debug(`Evaluating safe standalone function: ${funcName}`);
-                // Parse and evaluate arguments
-                const args = [];
-                if (argsString.trim()) {
-                    // Simple argument parsing (supports literals and variables)
-                    const argParts = argsString.split(',').map(arg => arg.trim());
-                    for (const argPart of argParts) {
-                        let argValue;
-                        // Handle string literals
-                        if ((argPart.startsWith('"') && argPart.endsWith('"')) ||
-                            (argPart.startsWith("'") && argPart.endsWith("'"))) {
-                            argValue = argPart.slice(1, -1);
-                        }
-                        // Handle number literals
-                        else if (!isNaN(Number(argPart))) {
-                            argValue = Number(argPart);
-                        }
-                        // Handle boolean literals
-                        else if (argPart === 'true' || argPart === 'false') {
-                            argValue = argPart === 'true';
-                        }
-                        // Handle variables
-                        else {
-                            const varResult = resolveSimpleVariable(argPart, variables, contextStack, engine);
-                            if (varResult && !varResult.startsWith('[undefined:')) {
-                                argValue = varResult;
-                            }
-                            else if (engine) {
-                                const sessionResult = resolveEngineSessionVariable(argPart, engine);
-                                argValue = sessionResult !== undefined ? sessionResult : argPart;
-                            }
-                            else {
-                                argValue = argPart;
-                            }
-                        }
-                        args.push(argValue);
-                    }
-                }
-                // Execute the safe function
-                try {
-                    switch (funcName) {
-                        case 'isNaN':
-                            logger.debug(`Executing isNaN with args: ${args}`);
-                            return isNaN(args[0]);
-                        case 'parseInt':
-                            logger.debug(`Executing parseInt with args: ${args}`);
-                            return parseInt(args[0], args[1] || 10);
-                        case 'parseFloat':
-                            logger.debug(`Executing parseFloat with args: ${args}`);
-                            return parseFloat(args[0]);
-                        case 'Boolean':
-                            logger.debug(`Executing Boolean with args: ${args}`);
-                            return Boolean(args[0]);
-                        case 'Number':
-                            logger.debug(`Executing Number with args: ${args}`);
-                            return Number(args[0]);
-                        case 'String':
-                            logger.debug(`Executing String with args: ${args}`);
-                            return String(args[0]);
-                        default:
-                            logger.warn(`Safe function ${funcName} not implemented`);
-                            return undefined;
-                    }
-                }
-                catch (error) {
-                    logger.debug(`Error executing safe function ${funcName}: ${error.message}`);
-                    return undefined;
-                }
-            }
-        }
-        // Handle extractCryptoFromInput(...) function call
-        const extractCryptoMatch = expression.match(/^extractCryptoFromInput\((.+)\)$/);
-        if (extractCryptoMatch) {
-            const argExpression = extractCryptoMatch[1].trim();
-            // Evaluate the argument expression (could be a variable or literal)
-            let argValue;
-            if (argExpression.startsWith('"') && argExpression.endsWith('"')) {
-                argValue = argExpression.slice(1, -1);
-            }
-            else if (argExpression.startsWith("'") && argExpression.endsWith("'")) {
-                argValue = argExpression.slice(1, -1);
-            }
-            else {
-                // Try to resolve as variable (could be userInput or other variable)
-                const varResult = resolveSimpleVariable(argExpression, variables, contextStack, engine);
-                if (varResult && !varResult.startsWith('[undefined:')) {
-                    argValue = varResult;
-                }
-                else if (engine) {
-                    // Try engine session variables
-                    const sessionResult = resolveEngineSessionVariable(argExpression, engine);
-                    if (sessionResult !== undefined) {
-                        argValue = String(sessionResult);
-                    }
-                    else {
-                        argValue = argExpression; // Use as literal if can't resolve
-                    }
-                }
-                else {
-                    argValue = argExpression; // Use as literal if can't resolve
-                }
-            }
-            logger.debug(`extractCryptoFromInput called with: ${argValue}`);
-            // Extract crypto name from input text
-            const cryptoNames = {
-                'bitcoin': 'bitcoin',
-                'btc': 'bitcoin',
-                'ethereum': 'ethereum',
-                'eth': 'ethereum',
-                'litecoin': 'litecoin',
-                'ltc': 'litecoin',
-                'dogecoin': 'dogecoin',
-                'doge': 'dogecoin',
-                'cardano': 'cardano',
-                'ada': 'cardano'
-            };
-            const lowerInput = argValue.toLowerCase();
-            for (const [key, value] of Object.entries(cryptoNames)) {
-                if (lowerInput.includes(key)) {
-                    logger.debug(`Extracted crypto: ${value}`);
-                    return value;
-                }
-            }
-            logger.debug(`No crypto found in input, defaulting to bitcoin`);
-            return 'bitcoin'; // Default fallback
-        }
-        return undefined; // Function not recognized
-    }
-    catch (error) {
-        logger.warn(`Function call evaluation error: ${error.message}`);
-        return undefined;
-    }
-}
-function getNestedValue(obj, path) {
-    if (!obj || typeof path !== 'string') {
-        return undefined;
-    }
-    if (!path.includes('.')) {
-        return obj[path];
-    }
-    const keys = path.split('.');
-    let current = obj;
-    for (const key of keys) {
-        if (current === null || current === undefined) {
-            return undefined;
-        }
-        current = current[key];
-    }
-    return current;
-}
-function evaluateSafeOrExpression(expression, variables, contextStack, engine) {
-    const parts = expression.split('||').map(part => part.trim());
-    for (const part of parts) {
-        if ((part.startsWith('"') && part.endsWith('"')) ||
-            (part.startsWith("'") && part.endsWith("'"))) {
-            return part.slice(1, -1);
-        }
-        if (isSimpleVariablePath(part)) {
-            if (variables && Object.keys(variables).length > 0) {
-                const val = part.split('.').reduce((obj, partKey) => obj?.[partKey], variables);
-                if (val !== undefined && val !== null && String(val) !== '') {
-                    return typeof val === 'object' ? JSON.stringify(val) : String(val);
-                }
-            }
-            // Check engine session variables if not found in variables
-            if (engine) {
-                const sessionValue = resolveEngineSessionVariable(part, engine);
-                if (sessionValue !== undefined && sessionValue !== null && String(sessionValue) !== '') {
-                    return typeof sessionValue === 'object' ? JSON.stringify(sessionValue) : String(sessionValue);
-                }
-            }
-        }
-    }
-    const lastPart = parts[parts.length - 1];
-    if ((lastPart.startsWith('"') && lastPart.endsWith('"')) ||
-        (lastPart.startsWith("'") && lastPart.endsWith("'"))) {
-        return lastPart.slice(1, -1);
-    }
-    // Final fallback - check for session variables in the last part
-    if (engine && isSimpleVariablePath(lastPart)) {
-        const sessionValue = resolveEngineSessionVariable(lastPart, engine);
-        if (sessionValue !== undefined) {
-            return typeof sessionValue === 'object' ? JSON.stringify(sessionValue) : String(sessionValue);
-        }
-    }
-    return '';
-}
-function evaluateSafeTernaryExpression(expression, variables, contextStack, engine) {
-    const ternaryMatch = expression.match(/^([a-zA-Z_$.]+)\s*(===|!==|==|!=|>=|<=|>|<)\s*(\d+|'[^']*'|"[^"]*"|true|false)\s*\?\s*('([^']*)'|"([^"]*)"|[a-zA-Z_$.]+)\s*:\s*('([^']*)'|"([^"]*)"|[a-zA-Z_$.]+)$/);
-    if (!ternaryMatch) {
-        return `[invalid-ternary: ${expression}]`;
-    }
-    const [, leftVar, operator, rightValue, , trueStr1, trueStr2, , falseStr1, falseStr2] = ternaryMatch;
-    let leftVal;
-    if (variables && Object.keys(variables).length > 0) {
-        leftVal = leftVar.split('.').reduce((obj, part) => obj?.[part], variables);
-    }
-    // Check engine session variables if not found
-    if (leftVal === undefined && engine) {
-        leftVal = resolveEngineSessionVariable(leftVar, engine);
-    }
-    if (leftVal === undefined) {
-        return `[undefined: ${leftVar}]`;
-    }
-    let rightVal;
-    if (rightValue === 'true')
-        rightVal = true;
-    else if (rightValue === 'false')
-        rightVal = false;
-    else if (/^\d+$/.test(rightValue))
-        rightVal = parseInt(rightValue);
-    else if (/^\d*\.\d+$/.test(rightValue))
-        rightVal = parseFloat(rightValue);
-    else if (rightValue.startsWith("'") && rightValue.endsWith("'"))
-        rightVal = rightValue.slice(1, -1);
-    else if (rightValue.startsWith('"') && rightValue.endsWith('"'))
-        rightVal = rightValue.slice(1, -1);
-    else
-        rightVal = rightValue;
-    let condition = false;
-    switch (operator) {
-        case '===':
-            condition = leftVal === rightVal;
-            break;
-        case '!==':
-            condition = leftVal !== rightVal;
-            break;
-        case '==':
-            condition = leftVal == rightVal;
-            break;
-        case '!=':
-            condition = leftVal != rightVal;
-            break;
-        case '>':
-            condition = leftVal > rightVal;
-            break;
-        case '<':
-            condition = leftVal < rightVal;
-            break;
-        case '>=':
-            condition = leftVal >= rightVal;
-            break;
-        case '<=':
-            condition = leftVal <= rightVal;
-            break;
-        default: return `[invalid-operator: ${operator}]`;
-    }
-    if (condition) {
-        return trueStr1 || trueStr2 || resolveSimpleVariable(trueStr2, variables, contextStack, engine) || '';
-    }
-    else {
-        return falseStr1 || falseStr2 || resolveSimpleVariable(falseStr2, variables, contextStack, engine) || '';
-    }
-}
-function evaluateSafeMathematicalExpression(expression, variables, contextStack, engine) {
-    try {
-        let evaluatedExpression = expression;
-        const variablePattern = /[a-zA-Z_$][a-zA-Z0-9_$]*(\.[a-zA-Z_$][a-zA-Z0-9_$]*)*/g;
-        const variables_found = expression.match(variablePattern) || [];
-        for (const varPath of [...new Set(variables_found)]) {
-            if (/^\d+(\.\d+)?$/.test(varPath))
-                continue;
-            let value = resolveSimpleVariable(varPath, variables, contextStack, engine);
-            const numValue = Number(value);
-            if (!isNaN(numValue)) {
-                value = String(numValue);
-            }
-            else if (value === undefined || value === null) {
-                value = '0';
-            }
-            const regex = new RegExp(`\\b${varPath.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`, 'g');
-            evaluatedExpression = evaluatedExpression.replace(regex, String(value));
-        }
-        if (!/^[\d+\-*/%().\s]+$/.test(evaluatedExpression)) {
-            return `[unsafe-math: ${expression}]`;
-        }
-        const result = new Function(`"use strict"; return (${evaluatedExpression})`)();
-        return String(result);
-    }
-    catch (error) {
-        logger.warn(`Mathematical expression evaluation error: ${error.message}`);
-        return `[math-error: ${expression}]`;
-    }
-}
-// Handle typeof operator expressions (e.g., "typeof variable", "typeof container.prop")
-function evaluateTypeofExpression(expression, variables, contextStack, engine) {
-    try {
-        // Extract the variable name after "typeof "
-        const typeofMatch = expression.trim().match(/^typeof\s+(.+)$/);
-        if (!typeofMatch) {
-            logger.warn(`Invalid typeof expression: ${expression}`);
-            return 'undefined';
-        }
-        const variablePath = typeofMatch[1].trim();
-        logger.debug(`Evaluating typeof for variable path: ${variablePath}`);
-        // Resolve the variable value
-        let value;
-        // Try to resolve from variables first
-        if (variables && Object.keys(variables).length > 0) {
-            value = variablePath.split('.').reduce((obj, part) => obj?.[part], variables);
-        }
-        // If not found in variables, check engine session variables
-        if (value === undefined && engine) {
-            value = resolveEngineSessionVariable(variablePath, engine);
-        }
-        // Return the JavaScript typeof result
-        const typeResult = typeof value;
-        logger.debug(`typeof ${variablePath} = ${typeResult} (value: ${JSON.stringify(value)})`);
-        return typeResult;
-    }
-    catch (error) {
-        logger.warn(`Typeof expression evaluation error: ${error.message}`);
-        return 'undefined';
-    }
+    return Boolean(result);
 }
 // === ENHANCED FLOW CONTROL COMMANDS ===
 // Universal commands that work during any flow
@@ -5071,10 +4587,28 @@ async function processActivity(input, userId, engine) {
             if (flowControlResult) {
                 return flowControlResult;
             }
-            // Check for strong intent interruption (new flows)
-            const interruptionResult = await handleIntentInterruption(String(sanitizedInput), engine, userId);
-            if (interruptionResult) {
-                return interruptionResult;
+            // Check for strong intent interruption (new flows) - only if current flow AND all parent flows are interruptable
+            const flowStacks = engine.flowStacks;
+            const currentStackIndex = flowStacks.length - 1;
+            const currentStack = flowStacks[currentStackIndex] || [];
+            let isAnyFlowNonInterruptable = false;
+            for (const flowFrame of currentStack) {
+                const flowDefinition = engine.flowsMenu.find((f) => f.name === flowFrame.flowName);
+                const isFlowInterruptable = flowDefinition?.interruptable ?? false; // Default to false
+                if (!isFlowInterruptable) {
+                    isAnyFlowNonInterruptable = true;
+                    logger.debug(`Flow "${flowFrame.flowName}" in stack is not interruptable`);
+                    break;
+                }
+            }
+            if (!isAnyFlowNonInterruptable) {
+                const interruptionResult = await handleIntentInterruption(String(sanitizedInput), engine, userId);
+                if (interruptionResult) {
+                    return interruptionResult;
+                }
+            }
+            else {
+                logger.debug(`Skipping intent interruption check - one or more flows in the stack are not interruptable`);
             }
             // Clear the last SAY message if we had one
             if (currentFlowFrame.lastSayMessage) {
@@ -5509,7 +5043,8 @@ export class WorkflowEngine {
             flowCallGraph: new Map(),
             currentDepth: 0,
             variableScopes: new Map(),
-            toolRegistry: new Set(this.toolsRegistry.map((t) => t.id))
+            toolRegistry: new Set(this.toolsRegistry.map((t) => t.id)),
+            flowCallStack: [] // Track parent flow chain for variable inheritance
         };
         try {
             this._validateFlowRecursive(flowName, validationState, opts);
@@ -5549,7 +5084,7 @@ export class WorkflowEngine {
             return;
         }
         // Find the flow definition
-        const flowDef = this.flowsMenu.find((f) => f.name === flowName);
+        const flowDef = this.flowsMenu.find((f) => f.id === flowName || f.name === flowName);
         if (!flowDef) {
             state.errors.push(`Flow not found: ${flowName}`);
             return;
@@ -5557,6 +5092,8 @@ export class WorkflowEngine {
         // Mark as visited
         state.visitedFlows.add(flowName);
         state.currentDepth++;
+        // Add to flow call stack for variable inheritance tracking
+        state.flowCallStack.push(flowName);
         // Initialize flow call graph
         if (!state.flowCallGraph.has(flowName)) {
             state.flowCallGraph.set(flowName, []);
@@ -5586,6 +5123,8 @@ export class WorkflowEngine {
                 this._validateFlowRecursive(calledFlow, state, opts);
             }
         }
+        // Remove from flow call stack when exiting this flow
+        state.flowCallStack.pop();
         state.currentDepth--;
     }
     /**
@@ -5975,7 +5514,7 @@ export class WorkflowEngine {
         // PHASE 2: Validate only top-level flows (not referenced as sub-flows)
         logger.info('🔍 Phase 2: Validating top-level flows...');
         for (const flow of this.flowsMenu) {
-            if (referencedSubFlows.has(flow.name)) {
+            if (referencedSubFlows.has(flow.name) || referencedSubFlows.has(flow.id)) {
                 // Skip validation of sub-flows - they'll be validated in parent context
                 logger.info(`⏭️  Skipping sub-flow "${flow.name}" - will be validated in parent context`);
                 results.skippedSubFlows.push(flow.name);
@@ -6024,11 +5563,24 @@ export class WorkflowEngine {
     // === ENHANCED VARIABLE SCOPE TRACKING ===
     /**
      * Gets the current variable scope available at a specific step
-     * This includes variables defined in flow definition + variables created by previous steps
+     * This includes variables defined in flow definition + variables created by previous steps + parent flow variables
      */
     _getCurrentStepScope(flowDef, stepIndex, state) {
         const scope = new Set();
-        // Add flow-defined variables
+        // Add parent flow variables (variable inheritance from call stack)
+        if (state.flowCallStack && state.flowCallStack.length > 0) {
+            // Iterate through parent flows in the call stack (excluding current flow)
+            for (let i = 0; i < state.flowCallStack.length - 1; i++) {
+                const parentFlowName = state.flowCallStack[i];
+                const parentFlowDef = this.flowsMenu.find((f) => f.id === parentFlowName || f.name === parentFlowName);
+                if (parentFlowDef && parentFlowDef.variables) {
+                    for (const varName of Object.keys(parentFlowDef.variables)) {
+                        scope.add(varName);
+                    }
+                }
+            }
+        }
+        // Add flow-defined variables (current flow)
         if (flowDef.variables) {
             for (const varName of Object.keys(flowDef.variables)) {
                 scope.add(varName);
@@ -6197,7 +5749,7 @@ export class WorkflowEngine {
                         const variableNames = extractVariableNames(varPath);
                         for (const rootVar of variableNames) {
                             // Check if it's a registered function first (global scope)
-                            const isApprovedFunction = this.APPROVED_FUNCTIONS && this.APPROVED_FUNCTIONS.get && this.APPROVED_FUNCTIONS.get(rootVar);
+                            const isApprovedFunction = this.APPROVED_FUNCTIONS && this.APPROVED_FUNCTIONS[rootVar];
                             // If not an approved function, check if it's in current scope as a variable
                             if (!isApprovedFunction && !currentScope.has(rootVar)) {
                                 state.errors.push(`${context} in step "${step.id}" references undefined variable: ${rootVar} (full path: ${varPath})`);