n8n 2.25.6 → 2.26.1

package/dist/modules/instance-ai/instance-ai.service.js

@@ -46,38 +46,43 @@ exports.InstanceAiService = void 0;
 const api_types_1 = require("@n8n/api-types");
 const backend_common_1 = require("@n8n/backend-common");
 const config_1 = require("@n8n/config");
-const decorators_1 = require("@n8n/decorators");
-const n8n_core_1 = require("n8n-core");
-const ssrf_protection_service_1 = require("../../services/ssrf/ssrf-protection.service");
 const db_1 = require("@n8n/db");
+const decorators_1 = require("@n8n/decorators");
 const di_1 = require("@n8n/di");
-const url_service_1 = require("../../services/url.service");
 const instance_ai_1 = require("@n8n/instance-ai");
 const workflow_sdk_1 = require("@n8n/workflow-sdk");
-const nanoid_1 = require("nanoid");
+const n8n_core_1 = require("n8n-core");
 const n8n_workflow_1 = require("n8n-workflow");
+const nanoid_1 = require("nanoid");
 const uuid_1 = require("uuid");
-const constants_1 = require("../../constants");
-const event_service_1 = require("../../events/event.service");
-const source_control_preferences_service_ee_1 = require("../../modules/source-control.ee/source-control-preferences.service.ee");
-const ai_service_1 = require("../../services/ai.service");
-const push_1 = require("../../push");
-const telemetry_1 = require("../../telemetry");
 const in_process_event_bus_1 = require("./event-bus/in-process-event-bus");
-const filesystem_1 = require("./filesystem");
+const instance_ai_gateway_service_1 = require("./instance-ai-gateway.service");
+const instance_ai_memory_service_1 = require("./instance-ai-memory.service");
 const instance_ai_settings_service_1 = require("./instance-ai-settings.service");
 const instance_ai_adapter_service_1 = require("./instance-ai.adapter.service");
 const internal_messages_1 = require("./internal-messages");
-const db_snapshot_storage_1 = require("./storage/db-snapshot-storage");
+const liveness_1 = require("./liveness");
+const mcp_1 = require("./mcp");
+const instance_ai_pending_confirmation_repository_1 = require("./repositories/instance-ai-pending-confirmation.repository");
+const instance_ai_thread_repository_1 = require("./repositories/instance-ai-thread.repository");
+const run_trace_metadata_1 = require("./run-trace-metadata");
+const sandbox_provider_1 = require("./sandbox-provider");
 const db_iteration_log_storage_1 = require("./storage/db-iteration-log-storage");
+const db_snapshot_storage_1 = require("./storage/db-snapshot-storage");
 const typeorm_agent_checkpoint_store_1 = require("./storage/typeorm-agent-checkpoint-store");
 const typeorm_agent_memory_1 = require("./storage/typeorm-agent-memory");
-const proxy_token_manager_1 = require("../../services/proxy-token-manager");
-const instance_ai_pending_confirmation_repository_1 = require("./repositories/instance-ai-pending-confirmation.repository");
-const instance_ai_thread_repository_1 = require("./repositories/instance-ai-thread.repository");
 const trace_replay_state_1 = require("./trace-replay-state");
-const liveness_1 = require("./liveness");
-const run_trace_metadata_1 = require("./run-trace-metadata");
+const workflow_verification_obligation_service_1 = require("./workflow-verification-obligation-service");
+const planned_task_action_runner_1 = require("./planned-task-action-runner");
+const workflow_verification_task_projector_1 = require("./workflow-verification-task-projector");
+const constants_1 = require("../../constants");
+const event_service_1 = require("../../events/event.service");
+const source_control_preferences_service_ee_1 = require("../../modules/source-control.ee/source-control-preferences.service.ee");
+const push_1 = require("../../push");
+const ai_service_1 = require("../../services/ai.service");
+const proxy_token_manager_1 = require("../../services/proxy-token-manager");
+const url_service_1 = require("../../services/url.service");
+const telemetry_1 = require("../../telemetry");
 function getErrorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -87,6 +92,7 @@ function isTelemetryConfigurableAgent(agent) {
         typeof Reflect.get(agent, 'telemetry') === 'function');
 }
 const INSTANCE_AI_CHECKPOINT_PRUNE_RETRY_MS = 30 * 1000;
+const WORKFLOW_SETUP_ROUTING_CLAIM_TTL_MS = 15 * 60 * 1000;
 const INSTANCE_AI_SHUTDOWN_DRAIN_TIMEOUT_MS = 5 * 1000;
 function isTextMessagePart(part) {
     return (typeof part === 'object' &&
@@ -325,11 +331,13 @@ let InstanceAiService = class InstanceAiService {
         }
         return this._mcpClientManager;
     }
-    constructor(logger, globalConfig, instanceSettings, adapterService, eventBus, settingsService, agentMemory, checkpointStore, aiService, push, threadRepo, pendingConfirmationRepo, urlService, dbSnapshotStorage, dbIterationLogStorage, sourceControlPreferencesService, telemetry, userRepository, aiBuilderTemporaryWorkflowRepository, errorReporter, ssrfProtectionConfig, ssrfProtectionService, eventService) {
+    constructor(logger, globalConfig, instanceSettings, adapterService, eventBus, settingsService, gatewayService, memoryService, agentMemory, checkpointStore, aiService, push, threadRepo, pendingConfirmationRepo, urlService, dbSnapshotStorage, dbIterationLogStorage, sourceControlPreferencesService, telemetry, mcpRegistryService, userRepository, aiBuilderTemporaryWorkflowRepository, errorReporter, ssrfProtectionConfig, ssrfProtectionService, eventService) {
         this.instanceSettings = instanceSettings;
         this.adapterService = adapterService;
         this.eventBus = eventBus;
         this.settingsService = settingsService;
+        this.gatewayService = gatewayService;
+        this.memoryService = memoryService;
         this.agentMemory = agentMemory;
         this.checkpointStore = checkpointStore;
         this.aiService = aiService;
@@ -341,6 +349,7 @@ let InstanceAiService = class InstanceAiService {
         this.dbIterationLogStorage = dbIterationLogStorage;
         this.sourceControlPreferencesService = sourceControlPreferencesService;
         this.telemetry = telemetry;
+        this.mcpRegistryService = mcpRegistryService;
         this.userRepository = userRepository;
         this.aiBuilderTemporaryWorkflowRepository = aiBuilderTemporaryWorkflowRepository;
         this.errorReporter = errorReporter;
@@ -350,7 +359,6 @@ let InstanceAiService = class InstanceAiService {
         this.traceContextsByRunId = new Map();
         this.sandboxes = new Map();
         this.sandboxCreations = new Map();
-        this.gatewayRegistry = new filesystem_1.LocalGatewayRegistry();
         this.domainAccessTrackersByThread = new Map();
         this.threadPushRef = new Map();
         this.planRequestsByThread = new Map();
@@ -364,6 +372,8 @@ let InstanceAiService = class InstanceAiService {
         this.preserveHitlOnShutdown = new Set();
         this.userMessagePersistenceByRun = new Map();
         this.logger = logger.scoped('instance-ai');
+        this.workflowObligations = new workflow_verification_obligation_service_1.WorkflowVerificationObligationService(this.agentMemory);
+        this.taskProjector = new workflow_verification_task_projector_1.WorkflowVerificationTaskProjector(this.agentMemory, this.eventBus, this.logger, this.workflowObligations);
         this.instanceAiConfig = globalConfig.instanceAi;
         const livenessPolicyConfig = (0, instance_ai_1.createInstanceAiLivenessPolicyConfig)({
             confirmationTimeoutMs: this.instanceAiConfig.confirmationTimeout,
@@ -406,18 +416,15 @@ let InstanceAiService = class InstanceAiService {
     }
     getSandboxConfigFromEnv() {
         const { sandboxEnabled, sandboxProvider, daytonaApiUrl, daytonaApiKey, n8nSandboxServiceUrl, n8nSandboxServiceApiKey, sandboxImage, sandboxTimeout, sandboxNamePrefix, daytonaTokenRefreshSkewMs, } = this.instanceAiConfig;
+        const provider = (0, sandbox_provider_1.normalizeSandboxProvider)(sandboxProvider);
         if (!sandboxEnabled) {
             return {
                 enabled: false,
-                provider: sandboxProvider === 'n8n-sandbox'
-                    ? 'n8n-sandbox'
-                    : sandboxProvider === 'daytona'
-                        ? 'daytona'
-                        : 'local',
+                provider,
                 timeout: sandboxTimeout,
             };
         }
-        if (sandboxProvider === 'daytona') {
+        if (provider === 'daytona') {
             return {
                 enabled: true,
                 provider: 'daytona',
@@ -430,18 +437,11 @@ let InstanceAiService = class InstanceAiService {
                 refreshSkewMs: daytonaTokenRefreshSkewMs,
             };
         }
-        if (sandboxProvider === 'n8n-sandbox') {
-            return {
-                enabled: true,
-                provider: 'n8n-sandbox',
-                serviceUrl: n8nSandboxServiceUrl || undefined,
-                apiKey: n8nSandboxServiceApiKey || undefined,
-                timeout: sandboxTimeout,
-            };
-        }
         return {
             enabled: true,
-            provider: 'local',
+            provider: 'n8n-sandbox',
+            serviceUrl: (0, sandbox_provider_1.requireN8nSandboxServiceUrl)(n8nSandboxServiceUrl),
+            apiKey: n8nSandboxServiceApiKey || undefined,
             timeout: sandboxTimeout,
         };
     }
@@ -471,15 +471,12 @@ let InstanceAiService = class InstanceAiService {
                 daytonaApiKey: daytona.apiKey ?? base.daytonaApiKey,
             };
         }
-        if (base.provider === 'n8n-sandbox') {
-            const sandbox = await this.settingsService.resolveN8nSandboxConfig(user);
-            return {
-                ...base,
-                serviceUrl: sandbox.serviceUrl ?? base.serviceUrl,
-                apiKey: sandbox.apiKey ?? base.apiKey,
-            };
-        }
-        return base;
+        const sandbox = await this.settingsService.resolveN8nSandboxConfig(user);
+        return {
+            ...base,
+            serviceUrl: sandbox.serviceUrl ?? base.serviceUrl,
+            apiKey: sandbox.apiKey ?? base.apiKey,
+        };
     }
     async getOrCreateWorkspaceEntry(threadId, user) {
         const existing = this.sandboxes.get(threadId);
@@ -755,6 +752,12 @@ let InstanceAiService = class InstanceAiService {
         return this.runState.getThreadStatus(threadId, this.backgroundTasks.getTaskSnapshots(threadId));
     }
     storeTraceContext(runId, threadId, tracing, messageGroupId) {
+        const existing = this.traceContextsByRunId.get(runId);
+        if (existing?.tracing.traceWriter &&
+            existing.traceSlug &&
+            existing.tracing.traceWriter !== tracing.traceWriter) {
+            this.traceReplay.preserveWriterEvents(existing.traceSlug, existing.tracing.traceWriter.getEvents());
+        }
         this.traceContextsByRunId.set(runId, {
             threadId,
             messageGroupId,
@@ -881,6 +884,20 @@ let InstanceAiService = class InstanceAiService {
             }
         }
     }
+    deleteTraceContextsForSlug(slug) {
+        for (const [runId, entry] of this.traceContextsByRunId) {
+            if (entry.traceSlug === slug) {
+                (0, instance_ai_1.releaseTraceClient)(entry.tracing.rootRun.traceId);
+                this.traceContextsByRunId.delete(runId);
+            }
+        }
+    }
+    clearTraceContextsForTest() {
+        for (const entry of this.traceContextsByRunId.values()) {
+            (0, instance_ai_1.releaseTraceClient)(entry.tracing.rootRun.traceId);
+        }
+        this.traceContextsByRunId.clear();
+    }
     async finalizeDetachedTraceRun(taskId, traceContext, options) {
         if (!traceContext)
             return;
@@ -1233,66 +1250,23 @@ let InstanceAiService = class InstanceAiService {
     getTraceEvents(slug) {
         return this.traceReplay.getEventsWithWriterFallback(slug, this.traceContextsByRunId.values());
     }
+    hasRunningWorkForTest() {
+        const threadIds = new Set([...this.traceContextsByRunId.values()].map((entry) => entry.threadId));
+        for (const threadId of threadIds) {
+            if (this.runState.getActiveRunId(threadId))
+                return true;
+            if (this.backgroundTasks.getRunningTasks(threadId).length > 0)
+                return true;
+        }
+        return false;
+    }
     activateTraceSlug(slug) {
         this.traceReplay.activateSlug(slug);
     }
     clearTraceEvents(slug) {
+        this.deleteTraceContextsForSlug(slug);
         this.traceReplay.clearEvents(slug);
     }
-    getUserIdForApiKey(key) {
-        return this.gatewayRegistry.getUserIdForApiKey(key);
-    }
-    generatePairingToken(userId) {
-        return this.gatewayRegistry.generatePairingToken(userId);
-    }
-    getGatewayApiKeyExpiresAt(userId, key) {
-        return this.gatewayRegistry.getApiKeyExpiresAt(userId, key);
-    }
-    getPairingToken(userId) {
-        return this.gatewayRegistry.getPairingToken(userId);
-    }
-    consumePairingToken(userId, token) {
-        return this.gatewayRegistry.consumePairingToken(userId, token);
-    }
-    getActiveSessionKey(userId) {
-        return this.gatewayRegistry.getActiveSessionKey(userId);
-    }
-    clearActiveSessionKey(userId) {
-        this.gatewayRegistry.clearActiveSessionKey(userId);
-    }
-    getLocalGateway(userId) {
-        return this.gatewayRegistry.getGateway(userId);
-    }
-    initGateway(userId, data) {
-        this.gatewayRegistry.initGateway(userId, data);
-        this.telemetry.track('User connected to Computer Use', {
-            user_id: userId,
-            tool_groups: data.toolCategories.filter((c) => c.enabled).map((c) => c.name),
-        });
-    }
-    resolveGatewayRequest(userId, requestId, result, error) {
-        return this.gatewayRegistry.resolveGatewayRequest(userId, requestId, result, error);
-    }
-    disconnectGateway(userId) {
-        this.gatewayRegistry.disconnectGateway(userId);
-    }
-    disconnectAllGateways() {
-        const connectedUserIds = this.gatewayRegistry.getConnectedUserIds();
-        this.gatewayRegistry.disconnectAll();
-        return connectedUserIds;
-    }
-    isLocalGatewayDisabled() {
-        return this.settingsService.isLocalGatewayDisabled();
-    }
-    getGatewayStatus(userId) {
-        return this.gatewayRegistry.getGatewayStatus(userId);
-    }
-    startDisconnectTimer(userId, onDisconnect) {
-        this.gatewayRegistry.startDisconnectTimer(userId, onDisconnect);
-    }
-    clearDisconnectTimer(userId) {
-        this.gatewayRegistry.clearDisconnectTimer(userId);
-    }
     async clearThreadState(threadId) {
         this.liveness.clearThreadState(threadId);
         const { active, suspended } = this.runState.clearThread(threadId);
@@ -1373,7 +1347,7 @@ let InstanceAiService = class InstanceAiService {
                 metadata: { completion_source: 'service_cleanup' },
             });
         }
-        this.gatewayRegistry.disconnectAll();
+        this.gatewayService.disconnectAll();
         this.stopSandboxExpiryTimers();
         this.domainAccessTrackersByThread.clear();
         this.traceContextsByRunId.clear();
@@ -1382,7 +1356,7 @@ let InstanceAiService = class InstanceAiService {
         this.logger.debug('Instance AI service shut down');
     }
     startCheckpointPruning() {
-        if (this.checkpointPruneTimer || this.instanceAiConfig.snapshotPruneInterval <= 0)
+        if (this.checkpointPruneTimer || this.instanceAiConfig.pruneInterval <= 0)
             return;
         this.checkpointPruningStopped = false;
         this.scheduleCheckpointPrune(0);
@@ -1392,11 +1366,11 @@ let InstanceAiService = class InstanceAiService {
         clearTimeout(this.checkpointPruneTimer);
         this.checkpointPruneTimer = undefined;
     }
-    scheduleCheckpointPrune(delayMs = this.instanceAiConfig.snapshotPruneInterval) {
+    scheduleCheckpointPrune(delayMs = this.instanceAiConfig.pruneInterval) {
         if (this.checkpointPruningStopped)
             return;
         this.checkpointPruneTimer = setTimeout(() => {
-            void this.pruneStaleCheckpoints();
+            void this.runScheduledPrune();
         }, delayMs);
         this.checkpointPruneTimer.unref();
     }
@@ -1438,7 +1412,7 @@ let InstanceAiService = class InstanceAiService {
             });
         }
     }
-    async pruneStaleCheckpoints(now = Date.now()) {
+    async runScheduledPrune(now = Date.now()) {
         const olderThan = new Date(now - this.instanceAiConfig.snapshotRetention);
         try {
             const count = await this.checkpointStore.markExpiredOlderThan(olderThan);
@@ -1449,6 +1423,7 @@ let InstanceAiService = class InstanceAiService {
                 this.logger.debug('No stale Instance AI checkpoints to expire');
             }
             await this.pruneStalePendingConfirmations(now);
+            await this.pruneExpiredThreads();
             this.scheduleCheckpointPrune();
         }
         catch (error) {
@@ -1458,6 +1433,16 @@ let InstanceAiService = class InstanceAiService {
             this.scheduleCheckpointPrune(INSTANCE_AI_CHECKPOINT_PRUNE_RETRY_MS);
         }
     }
+    async pruneExpiredThreads() {
+        try {
+            await this.memoryService.cleanupExpiredThreads(async (threadId) => await this.clearThreadState(threadId));
+        }
+        catch (error) {
+            this.logger.warn('Failed to clean up expired Instance AI conversation threads', {
+                error: getErrorMessage(error),
+            });
+        }
+    }
     async pruneStalePendingConfirmations(now) {
         try {
             const count = await this.pendingConfirmationRepo.deleteExpired(new Date(now));
@@ -1568,31 +1553,56 @@ let InstanceAiService = class InstanceAiService {
             },
         };
     }
-    async ensureThreadExists(memory, threadId, resourceId) {
-        const existingThread = await memory.getThread(threadId);
-        if (existingThread)
-            return;
-        await memory.saveThread({
-            id: threadId,
-            resourceId,
-            title: '',
-        });
-    }
-    projectPlannedTaskList(graph) {
+    createWorkflowTaskServiceWithUiSync(threadId, runId, workflowTasks) {
+        const sync = async () => await this.taskProjector.syncFromWorkflowLoop(threadId, runId);
         return {
-            tasks: graph.tasks.map((task) => ({
-                id: task.id,
-                description: task.title,
-                status: task.status === 'planned'
-                    ? 'todo'
-                    : task.status === 'running'
-                        ? 'in_progress'
-                        : task.status === 'succeeded'
-                            ? 'done'
-                            : task.status,
-            })),
+            reportBuildOutcome: async (outcome) => {
+                const action = await workflowTasks.reportBuildOutcome(outcome);
+                await sync();
+                return action;
+            },
+            reportVerificationVerdict: async (verdict) => {
+                const action = await workflowTasks.reportVerificationVerdict(verdict);
+                await sync();
+                return action;
+            },
+            updateBuildOutcome: async (workItemId, update) => {
+                await workflowTasks.updateBuildOutcome(workItemId, update);
+                await sync();
+            },
+            getBuildOutcome: async (workItemId) => await workflowTasks.getBuildOutcome(workItemId),
+            getWorkflowLoopState: async (workItemId) => await workflowTasks.getWorkflowLoopState(workItemId),
         };
     }
+    trackWorkflowVerificationObligation(obligation, event, extra = {}) {
+        try {
+            this.telemetry?.track('instance_ai_workflow_verification_obligation', {
+                event,
+                thread_id: obligation.threadId,
+                run_id: obligation.runId,
+                task_id: obligation.taskId,
+                planned_task_id: obligation.plannedTaskId,
+                work_item_id: obligation.workItemId,
+                workflow_id: obligation.workflowId,
+                source: obligation.source,
+                policy: obligation.policy,
+                status: obligation.status,
+                readiness_status: obligation.readiness?.status,
+                setup_status: obligation.setupRequirement?.status,
+                has_evidence: obligation.evidence?.attempted === true,
+                evidence_success: obligation.evidence?.success,
+                blocking_reason: obligation.blockingReason,
+                ...extra,
+            });
+        }
+        catch (error) {
+            this.logger.warn('Failed to track workflow verification obligation telemetry', {
+                threadId: obligation.threadId,
+                workItemId: obligation.workItemId,
+                error: getErrorMessage(error),
+            });
+        }
+    }
     buildPlannedTaskFollowUpMessage(type, graph, options = {}) {
         const payload = {
             tasks: graph.tasks.map((task) => ({
@@ -1632,8 +1642,27 @@ let InstanceAiService = class InstanceAiService {
                 dependsOn: depOutcomes,
             };
         }
+        if (options.buildTask) {
+            payload.buildTask = {
+                id: options.buildTask.id,
+                title: options.buildTask.title,
+                kind: options.buildTask.kind,
+                spec: options.buildTask.spec,
+                workflowId: options.buildTask.workflowId,
+                isSupportingWorkflow: options.buildTask.isSupportingWorkflow,
+                deps: options.buildTask.deps,
+            };
+        }
         return `<planned-task-follow-up type="${type}">\n${JSON.stringify(payload, null, 2)}\n</planned-task-follow-up>\n\n${internal_messages_1.AUTO_FOLLOW_UP_MESSAGE}`;
     }
+    buildWorkflowVerificationFollowUpMessage(input) {
+        const payload = {
+            obligation: input.obligation,
+            outcome: input.outcome,
+            sourceTask: input.sourceTask,
+        };
+        return `<workflow-verification-follow-up>\n${JSON.stringify(payload, null, 2)}\n</workflow-verification-follow-up>\n\n${internal_messages_1.AUTO_FOLLOW_UP_MESSAGE}`;
+    }
     async createPlannedTaskState() {
         const memory = this.agentMemory;
         const taskStorage = new instance_ai_1.ThreadTaskStorage(memory);
@@ -1651,6 +1680,7 @@ let InstanceAiService = class InstanceAiService {
         const decision = guard.evaluateTerminal(this.getTerminalGuardEvents(threadId, runId, options.messageGroupId), status, {
             workSummary: options.workSummary,
             errorMessage: options.errorMessage,
+            suppressCompletedFallback: options.suppressCompletedFallback,
         });
         this.handleTerminalResponseDecision(threadId, runId, decision, options.messageGroupId);
         return decision;
@@ -1930,7 +1960,7 @@ let InstanceAiService = class InstanceAiService {
     }
     async syncPlannedTasksToUi(threadId, graph) {
         const { taskStorage } = await this.createPlannedTaskState();
-        const tasks = this.projectPlannedTaskList(graph);
+        const tasks = await this.taskProjector.projectPlannedTaskList(threadId, graph);
         await taskStorage.save(threadId, tasks);
         this.eventBus.publish(threadId, {
             type: 'tasks-update',
@@ -1962,10 +1992,15 @@ let InstanceAiService = class InstanceAiService {
         }
     }
     async createExecutionEnvironment(user, threadId, runId, abortSignal, messageGroupId, pushRef) {
+        const memory = this.agentMemory;
+        const boundProjectId = await memory.getThreadProjectId(threadId);
+        if (!boundProjectId) {
+            throw new n8n_workflow_1.UnexpectedError(`Instance AI thread "${threadId}" has no bound project; it must be created via POST /instance-ai/threads before a run can start`);
+        }
         const adminSettings = this.settingsService.getAdminSettings();
         const localGatewayDisabledGlobally = adminSettings.localGatewayDisabled;
         const localGatewayDisabledForUser = await this.settingsService.isLocalGatewayDisabledForUser(user.id);
-        const userGateway = this.gatewayRegistry.findGateway(user.id);
+        const userGateway = this.gatewayService.findGateway(user.id);
         let searchProxyConfig;
         let tracingProxyConfig;
         let tokenManager;
@@ -2000,6 +2035,7 @@ let InstanceAiService = class InstanceAiService {
             searchProxyConfig,
             pushRef,
             threadId,
+            projectId: boundProjectId,
         });
         if (!localGatewayDisabledForUser && userGateway?.isConnected) {
             context.localMcpServer = userGateway;
@@ -2036,13 +2072,11 @@ let InstanceAiService = class InstanceAiService {
         const modelId = proxyBaseUrl && tokenManager
             ? await this.resolveProxyModel(user, proxyBaseUrl, tokenManager)
             : await this.resolveAgentModelConfig(user);
-        const memory = this.agentMemory;
-        await this.ensureThreadExists(memory, threadId, user.id);
         const taskStorage = new instance_ai_1.ThreadTaskStorage(memory);
         const iterationLog = this.dbIterationLogStorage;
         const snapshotStorage = this.dbSnapshotStorage;
         const workflowLoopStorage = new instance_ai_1.WorkflowLoopStorage(memory);
-        const workflowTasks = new instance_ai_1.WorkflowTaskCoordinator(threadId, workflowLoopStorage);
+        const workflowTasks = this.createWorkflowTaskServiceWithUiSync(threadId, runId, new instance_ai_1.WorkflowTaskCoordinator(threadId, workflowLoopStorage));
         const plannedTaskStorage = new instance_ai_1.PlannedTaskStorage(memory);
         const plannedTaskService = new instance_ai_1.PlannedTaskCoordinator(plannedTaskStorage);
         const nodeDefDirs = this.adapterService.getNodeDefinitionDirs();
@@ -2053,37 +2087,50 @@ let InstanceAiService = class InstanceAiService {
         const baseRuntimeSkills = (0, instance_ai_1.loadInstanceAiRuntimeSkillSource)();
         let runtimeSkills = baseRuntimeSkills;
         let runtimeWorkspace;
-        if (adminSettings.sandboxEnabled) {
-            let sandboxEntryPromise;
-            const getSandboxEntry = async () => {
-                sandboxEntryPromise ??= this.getOrCreateWorkspaceEntry(threadId, user).catch((error) => {
-                    sandboxEntryPromise = undefined;
-                    throw error;
+        let workspaceRoot;
+        const sandboxStatus = this.settingsService.getSandboxStatus();
+        if (sandboxStatus.workflowBuilderAvailable) {
+            const sandboxConfig = await this.resolveSandboxConfig(user);
+            if (sandboxConfig.enabled) {
+                workspaceRoot = (0, instance_ai_1.getPromptWorkspaceRoot)(sandboxConfig.provider);
+                let sandboxEntryPromise;
+                const getSandboxEntry = async () => {
+                    sandboxEntryPromise ??= this.getOrCreateWorkspaceEntry(threadId, user).catch((error) => {
+                        sandboxEntryPromise = undefined;
+                        throw error;
+                    });
+                    return await sandboxEntryPromise;
+                };
+                const getSetupSandboxEntry = async () => {
+                    return await this.getOrCreateWorkspace(threadId, user, context);
+                };
+                const scopeWorkspaceForAgent = async (workspace) => {
+                    if (!workspace)
+                        return undefined;
+                    const root = await (0, instance_ai_1.getWorkspaceRoot)(workspace);
+                    return (0, instance_ai_1.createScopedWorkspace)(workspace, root);
+                };
+                runtimeWorkspace = (0, instance_ai_1.createLazyRuntimeWorkspace)({
+                    ensureWorkspace: async () => await scopeWorkspaceForAgent((await getSetupSandboxEntry())?.workspace),
                 });
-                return await sandboxEntryPromise;
-            };
-            const getSetupSandboxEntry = async () => {
-                return await this.getOrCreateWorkspace(threadId, user, context);
-            };
-            runtimeWorkspace = (0, instance_ai_1.createLazyRuntimeWorkspace)({
-                ensureWorkspace: async () => (await getSetupSandboxEntry())?.workspace,
-            });
-            const runtimeSkillWorkspace = (0, instance_ai_1.createLazyRuntimeWorkspace)({
-                id: 'instance-ai-runtime-skill-workspace',
-                name: 'Instance AI runtime skill workspace',
-                ensureWorkspace: async () => (await getSandboxEntry())?.workspace,
-            });
-            runtimeSkills = (0, instance_ai_1.createLazyWorkspaceRuntimeSkillSource)({
-                source: baseRuntimeSkills,
-                workspace: runtimeSkillWorkspace,
-                logger: this.logger,
-            });
+                const runtimeSkillWorkspace = (0, instance_ai_1.createLazyRuntimeWorkspace)({
+                    id: 'instance-ai-runtime-skill-workspace',
+                    name: 'Instance AI runtime skill workspace',
+                    ensureWorkspace: async () => await scopeWorkspaceForAgent((await getSandboxEntry())?.workspace),
+                });
+                runtimeSkills = (0, instance_ai_1.createLazyWorkspaceRuntimeSkillSource)({
+                    source: baseRuntimeSkills,
+                    workspace: runtimeSkillWorkspace,
+                    logger: this.logger,
+                });
+            }
         }
         const orchestrationContext = {
             threadId,
             runId,
             messageGroupId,
             userId: user.id,
+            projectId: boundProjectId,
             orchestratorAgentId: ORCHESTRATOR_AGENT_ID,
             modelId,
             checkpointStore: this.checkpointStore,
@@ -2134,12 +2181,12 @@ let InstanceAiService = class InstanceAiService {
             schedulePlannedTasks: async () => await this.schedulePlannedTasks(user, threadId),
             iterationLog,
             sendCorrectionToTask: (taskId, correction) => this.sendCorrectionToTask(threadId, taskId, correction),
-            findSubAgentResumeInfo: async (agentKind) => await this.checkpointStore.findSuspendedSubAgentResumeInfo((0, instance_ai_1.createSubAgentResourceId)(threadId, agentKind)),
             persistInFlightUserMessage: async () => {
                 await this.persistUserMessageOnFirstSuspend(threadId, runId);
             },
             workflowTaskService: workflowTasks,
             workspace: runtimeWorkspace,
+            workspaceRoot,
             nodeDefinitionDirs: nodeDefDirs.length > 0 ? nodeDefDirs : undefined,
             domainContext: context,
             tracingProxyConfig,
@@ -2161,24 +2208,14 @@ let InstanceAiService = class InstanceAiService {
         const taskContext = this.createPlannedTaskContext(task.kind, context);
         const conversationContext = buildPlannedTaskConversationContext(task, graph);
         let started = null;
-        switch (task.kind) {
-            case 'build-workflow':
-                started = await (0, instance_ai_1.startBuildWorkflowAgentTask)(taskContext, {
-                    task: task.spec,
-                    workflowId: task.workflowId,
-                    plannedTaskId: task.id,
-                    conversationContext,
-                });
-                break;
-            case 'delegate':
-                started = await (0, instance_ai_1.startDetachedDelegateTask)(taskContext, {
-                    title: task.title,
-                    spec: task.spec,
-                    tools: task.tools ?? [],
-                    plannedTaskId: task.id,
-                    conversationContext,
-                });
-                break;
+        if (task.kind === 'delegate') {
+            started = await (0, instance_ai_1.startDetachedDelegateTask)(taskContext, {
+                title: task.title,
+                spec: task.spec,
+                tools: task.tools ?? [],
+                plannedTaskId: task.id,
+                conversationContext,
+            });
         }
         if (!started?.taskId) {
             await context.plannedTaskService?.markFailed(context.threadId, task.id, {
@@ -2207,24 +2244,79 @@ let InstanceAiService = class InstanceAiService {
             domainTools: (0, instance_ai_1.createAllTools)(taskDomainContext),
         };
     }
-    async getCheckpointAllowedWorkflowIds(threadId, checkpointTaskId) {
+    collectWorkflowIds(value, workflowIds) {
+        if (value === null || value === undefined || typeof value !== 'object')
+            return;
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                this.collectWorkflowIds(item, workflowIds);
+            }
+            return;
+        }
+        for (const [key, child] of Object.entries(value)) {
+            if (key === 'workflowId' && typeof child === 'string' && child.length > 0) {
+                workflowIds.add(child);
+                continue;
+            }
+            if (key === 'supportingWorkflowIds' && Array.isArray(child)) {
+                for (const workflowId of child) {
+                    if (typeof workflowId === 'string' && workflowId.length > 0) {
+                        workflowIds.add(workflowId);
+                    }
+                }
+                continue;
+            }
+            this.collectWorkflowIds(child, workflowIds);
+        }
+    }
+    getBuildTaskWorkflowName(task) {
+        if (task.kind !== 'build-workflow')
+            return undefined;
+        const titleMatch = task.title.match(/^Build '(.+)' workflow$/) ?? task.title.match(/^Build "(.+)" workflow$/);
+        return titleMatch?.[1];
+    }
+    checkpointRequiresRunApproval(graph, _checkpoint) {
+        return graph.postBuildRunApprovalRequired === true;
+    }
+    async getCheckpointRunPolicy(threadId, checkpointTaskId) {
         try {
             const { plannedTaskService } = await this.createPlannedTaskState();
             const graph = await plannedTaskService.getGraph(threadId);
             const checkpoint = graph?.tasks.find((t) => t.id === checkpointTaskId);
-            if (!graph || !checkpoint)
-                return new Set();
+            if (!graph || !checkpoint) {
+                return {
+                    allowedWorkflowIds: new Set(),
+                    allowedWorkflowNames: new Set(),
+                    requireApproval: false,
+                };
+            }
             const deps = new Set(checkpoint.deps);
-            const allowed = new Set();
+            const ids = new Set();
+            const names = new Set();
             for (const task of graph.tasks) {
                 if (!deps.has(task.id))
                     continue;
-                const workflowId = task.outcome?.workflowId;
-                if (typeof workflowId === 'string' && workflowId.length > 0) {
-                    allowed.add(workflowId);
+                const workflowName = this.getBuildTaskWorkflowName(task);
+                if (workflowName) {
+                    names.add(workflowName);
+                }
+                if (task.workflowId) {
+                    ids.add(task.workflowId);
+                }
+                this.collectWorkflowIds(task.outcome, ids);
+            }
+            const tracing = this.getTraceContextForContinuation(threadId);
+            for (const workflowId of [...ids]) {
+                const remappedWorkflowId = tracing?.idRemapper?.remapOutput(workflowId);
+                if (typeof remappedWorkflowId === 'string' && remappedWorkflowId.length > 0) {
+                    ids.add(remappedWorkflowId);
                 }
             }
-            return allowed;
+            return {
+                allowedWorkflowIds: ids,
+                allowedWorkflowNames: names,
+                requireApproval: this.checkpointRequiresRunApproval(graph, checkpoint),
+            };
         }
         catch (error) {
             this.logger.warn('Failed to resolve checkpoint allowed workflow IDs', {
@@ -2232,7 +2324,11 @@ let InstanceAiService = class InstanceAiService {
                 checkpointTaskId,
                 error: error instanceof Error ? error.message : String(error),
             });
-            return new Set();
+            return {
+                allowedWorkflowIds: new Set(),
+                allowedWorkflowNames: new Set(),
+                requireApproval: false,
+            };
         }
     }
     async handlePlannedTaskSettlement(user, task, status) {
@@ -2261,7 +2357,108 @@ let InstanceAiService = class InstanceAiService {
         }
         await this.schedulePlannedTasks(user, task.threadId);
     }
-    async startInternalFollowUpRun(user, threadId, message, messageGroupId, isReplanFollowUp = false, checkpoint) {
+    async maybeStartWorkflowVerificationFollowUp(user, task) {
+        if (task.role !== 'workflow-builder' || !task.workItemId)
+            return false;
+        const obligation = await this.workflowObligations.getObligation(task.threadId, task.workItemId, {
+            source: task.plannedTaskId ? 'planned' : 'direct',
+            plannedTaskId: task.plannedTaskId,
+        });
+        if (!obligation)
+            return false;
+        this.trackWorkflowVerificationObligation(obligation, 'background_task_settled');
+        if (obligation.status !== 'ready_to_verify' && obligation.status !== 'verifying') {
+            return false;
+        }
+        const outcome = (0, workflow_verification_obligation_service_1.parseWorkflowBuildOutcome)(task.outcome);
+        const startedRunId = await this.startInternalFollowUpRun(user, task.threadId, this.buildWorkflowVerificationFollowUpMessage({
+            obligation,
+            outcome,
+            sourceTask: {
+                taskId: task.taskId,
+                role: task.role,
+                status: task.status,
+                result: task.result,
+                error: task.error,
+                plannedTaskId: task.plannedTaskId,
+                workItemId: task.workItemId,
+            },
+        }), task.messageGroupId, false, undefined, 'workflow_verification');
+        this.trackWorkflowVerificationObligation(obligation, 'follow_up_start_attempted', {
+            follow_up_started: startedRunId.length > 0,
+        });
+        return startedRunId.length > 0;
+    }
+    buildWorkflowSetupFollowUpMessage(obligation) {
+        const payload = {
+            workflowId: obligation.workflowId,
+            workItemId: obligation.workItemId,
+            setupRequirement: obligation.setupRequirement,
+            verificationReadiness: obligation.readiness,
+        };
+        return `<workflow-setup-required>\n${JSON.stringify(payload, null, 2)}\n</workflow-setup-required>\n\n${internal_messages_1.AUTO_FOLLOW_UP_MESSAGE}`;
+    }
+    async maybeStartWorkflowSetupFollowUp(user, threadId) {
+        const records = await this.listWorkflowLoopRecords(threadId);
+        if (records.length === 0)
+            return false;
+        for (const record of records) {
+            if (record.state.setupRoutedAt)
+                continue;
+            if (this.workflowObligations.isPlannedRecord(record))
+                continue;
+            const obligation = this.workflowObligations.obligationFromRecord(threadId, record, {
+                source: 'direct',
+            });
+            const verificationConcluded = obligation.status === 'verified' || obligation.status === 'needs_setup';
+            if (!verificationConcluded)
+                continue;
+            if (obligation.setupRequirement?.status !== 'required' || !obligation.workflowId)
+                continue;
+            const claim = await this.claimWorkItemSetupRouting(threadId, record);
+            if (!claim)
+                continue;
+            const startedRunId = await this.startInternalFollowUpRun(user, threadId, this.buildWorkflowSetupFollowUpMessage(obligation), this.runState.getMessageGroupId(threadId), false, undefined, 'workflow_setup');
+            if (startedRunId.length === 0) {
+                await this.releaseWorkItemSetupRoutingClaim(threadId, record.state.workItemId, claim.claimId);
+                return false;
+            }
+            const marked = await this.markWorkItemSetupRouted(threadId, record.state.workItemId, claim.claimId);
+            if (!marked) {
+                this.logger.warn('Workflow setup follow-up started but routing marker was not saved', {
+                    threadId,
+                    workItemId: record.state.workItemId,
+                });
+            }
+            this.trackWorkflowVerificationObligation(obligation, 'setup_follow_up_started');
+            return true;
+        }
+        return false;
+    }
+    async listWorkflowLoopRecords(threadId) {
+        return await new instance_ai_1.WorkflowLoopStorage(this.agentMemory).listWorkItems(threadId);
+    }
+    createWorkflowSetupRoutingClaim() {
+        const claimedAt = new Date();
+        const expiresAt = new Date(claimedAt.getTime() + WORKFLOW_SETUP_ROUTING_CLAIM_TTL_MS);
+        return {
+            claimId: `setup:${(0, nanoid_1.nanoid)()}`,
+            claimedAt: claimedAt.toISOString(),
+            expiresAt: expiresAt.toISOString(),
+        };
+    }
+    async claimWorkItemSetupRouting(threadId, record) {
+        const claim = this.createWorkflowSetupRoutingClaim();
+        const claimed = await new instance_ai_1.WorkflowLoopStorage(this.agentMemory).claimSetupRouting(threadId, record.state.workItemId, claim);
+        return claimed ? claim : null;
+    }
+    async markWorkItemSetupRouted(threadId, workItemId, claimId) {
+        return await new instance_ai_1.WorkflowLoopStorage(this.agentMemory).markSetupRouted(threadId, workItemId, claimId, new Date().toISOString());
+    }
+    async releaseWorkItemSetupRoutingClaim(threadId, workItemId, claimId) {
+        await new instance_ai_1.WorkflowLoopStorage(this.agentMemory).releaseSetupRoutingClaim(threadId, workItemId, claimId);
+    }
+    async startInternalFollowUpRun(user, threadId, message, messageGroupId, isReplanFollowUp = false, checkpoint, resumeReasonOverride, plannedBuild) {
         if (this.runState.hasLiveRun(threadId)) {
             this.logger.warn('Skipping internal follow-up: active run exists', { threadId });
             return '';
@@ -2272,12 +2469,13 @@ let InstanceAiService = class InstanceAiService {
             messageGroupId,
         });
         const timeZone = this.runState.getTimeZone(threadId) ?? this.defaultTimeZone;
-        const resumeReason = checkpoint
-            ? 'planned_checkpoint'
-            : isReplanFollowUp
-                ? 'replan'
-                : 'background_task_completed';
-        this.startExecuteRun(user, threadId, runId, message, abortController, undefined, messageGroupId, timeZone, isReplanFollowUp, checkpoint, resumeReason);
+        const resumeReason = resumeReasonOverride ??
+            (checkpoint
+                ? 'planned_checkpoint'
+                : isReplanFollowUp
+                    ? 'replan'
+                    : 'background_task_completed');
+        this.startExecuteRun(user, threadId, runId, message, abortController, undefined, messageGroupId, timeZone, isReplanFollowUp, checkpoint, resumeReason, plannedBuild);
         return runId;
     }
     async schedulePlannedTasks(user, threadId) {
@@ -2286,6 +2484,90 @@ let InstanceAiService = class InstanceAiService {
         this.schedulerLocks.set(threadId, current);
         await current;
     }
+    createPlannedTaskActionRunner(activeUser, threadId, plannedTaskService) {
+        const scope = { user: activeUser, threadId };
+        return new planned_task_action_runner_1.PlannedTaskActionRunner({
+            scope,
+            plannedTaskService,
+            logger: this.logger,
+            view: this.createPlannedTaskView(),
+            runGate: this.createPlannedTaskRunGate(),
+            dispatcher: this.createPlannedTaskDispatcher(),
+            followUps: this.createPlannedTaskFollowUps(),
+            workflowVerificationGate: this.createPlannedWorkflowVerificationGate(threadId),
+            workflowVerificationTracker: this.createPlannedWorkflowVerificationTracker(),
+        });
+    }
+    createPlannedTaskView() {
+        return {
+            sync: async (scope, graph) => await this.syncPlannedTasksToUi(scope.threadId, graph),
+        };
+    }
+    createPlannedTaskRunGate() {
+        return {
+            hasLiveRun: (threadId) => this.runState.hasLiveRun(threadId),
+        };
+    }
+    createPlannedTaskDispatcher() {
+        return {
+            dispatch: async ({ scope, graph, tasks }) => {
+                const context = await this.createPlannedTaskDispatchContext(scope.user, scope.threadId, graph);
+                for (const task of tasks) {
+                    await this.dispatchPlannedTask(task, context, graph);
+                }
+            },
+        };
+    }
+    createPlannedTaskFollowUps() {
+        return {
+            startReplan: async ({ scope, graph, failedTask }) => await this.startInternalFollowUpRun(scope.user, scope.threadId, this.buildPlannedTaskFollowUpMessage('replan', graph, { failedTask }), graph.messageGroupId, true, undefined, undefined, undefined),
+            startWorkflowVerification: async ({ scope, graph, verification }) => await this.startInternalFollowUpRun(scope.user, scope.threadId, this.buildWorkflowVerificationFollowUpMessage({
+                obligation: verification.obligation,
+                outcome: verification.outcome,
+                sourceTask: this.toWorkflowVerificationSourceTask(verification),
+            }), graph.messageGroupId, false, undefined, 'workflow_verification', undefined),
+            startSynthesis: async ({ scope, graph }) => await this.startInternalFollowUpRun(scope.user, scope.threadId, this.buildPlannedTaskFollowUpMessage('synthesize', graph), graph.messageGroupId, false, undefined, 'synthesize', undefined),
+            startWorkflowBuild: async ({ scope, graph, task, workItemId }) => {
+                const plannedBuild = {
+                    isPlannedBuildFollowUp: true,
+                    buildTaskId: task.id,
+                    workItemId,
+                    isSupportingWorkflowTask: task.isSupportingWorkflow === true,
+                };
+                return await this.startInternalFollowUpRun(scope.user, scope.threadId, this.buildPlannedTaskFollowUpMessage('build-workflow', graph, { buildTask: task }), graph.messageGroupId, false, undefined, undefined, plannedBuild);
+            },
+            startCheckpoint: async ({ scope, graph, task }) => await this.startInternalFollowUpRun(scope.user, scope.threadId, this.buildPlannedTaskFollowUpMessage('checkpoint', graph, { checkpoint: task }), graph.messageGroupId, false, { isCheckpointFollowUp: true, checkpointTaskId: task.id }, undefined, undefined),
+        };
+    }
+    createPlannedWorkflowVerificationGate(threadId) {
+        return {
+            revalidate: async (verification) => await this.workflowObligations.revalidatePlannedWorkflowVerification(threadId, verification),
+        };
+    }
+    toWorkflowVerificationSourceTask(verification) {
+        return {
+            taskId: verification.task.backgroundTaskId ?? verification.task.id,
+            role: 'workflow-builder',
+            status: 'completed',
+            result: verification.task.result,
+            error: verification.task.error,
+            plannedTaskId: verification.task.id,
+            workItemId: verification.obligation.workItemId,
+        };
+    }
+    createPlannedWorkflowVerificationTracker() {
+        return {
+            scheduled: ({ obligation }) => this.trackWorkflowVerificationObligation(obligation, 'planned_verification_scheduled'),
+            followUpStartAttempted: ({ obligation }, started) => this.trackWorkflowVerificationObligation(obligation, 'follow_up_start_attempted', {
+                follow_up_started: started,
+            }),
+        };
+    }
+    async createPlannedTaskDispatchContext(user, threadId, graph) {
+        const environment = await this.createExecutionEnvironment(user, threadId, graph.planRunId, createInertAbortSignal(), graph.messageGroupId, this.threadPushRef.get(threadId));
+        environment.orchestrationContext.tracing = this.getTraceContext(graph.planRunId);
+        return environment.orchestrationContext;
+    }
     async doSchedulePlannedTasks(user, threadId) {
         const revalidated = await this.revalidateActiveUser(user.id);
         if (!revalidated) {
@@ -2298,61 +2580,27 @@ let InstanceAiService = class InstanceAiService {
         }
         const activeUser = revalidated;
         const { plannedTaskService } = await this.createPlannedTaskState();
-        const graph = await plannedTaskService.getGraph(threadId);
-        if (!graph)
-            return;
-        await this.syncPlannedTasksToUi(threadId, graph);
-        const availableSlots = Math.max(0, MAX_CONCURRENT_BACKGROUND_TASKS_PER_THREAD -
-            this.backgroundTasks.getRunningTasks(threadId).length);
-        const action = await plannedTaskService.tick(threadId, { availableSlots });
-        if (action.type === 'none')
-            return;
-        if (action.type === 'replan') {
-            await this.syncPlannedTasksToUi(threadId, action.graph);
-            const startedRunId = await this.startInternalFollowUpRun(activeUser, threadId, this.buildPlannedTaskFollowUpMessage('replan', action.graph, {
-                failedTask: action.failedTask,
-            }), action.graph.messageGroupId, true);
-            if (!startedRunId) {
-                await plannedTaskService.revertToActive(threadId);
-            }
-            return;
-        }
-        if (action.type === 'synthesize') {
-            await this.syncPlannedTasksToUi(threadId, action.graph);
-            const startedRunId = await this.startInternalFollowUpRun(activeUser, threadId, this.buildPlannedTaskFollowUpMessage('synthesize', action.graph), action.graph.messageGroupId);
-            if (!startedRunId) {
-                await plannedTaskService.revertToActive(threadId);
-            }
-            return;
-        }
-        if (action.type === 'orchestrate-checkpoint') {
-            if (this.runState.hasLiveRun(threadId)) {
+        const actionRunner = this.createPlannedTaskActionRunner(activeUser, threadId, plannedTaskService);
+        while (true) {
+            const graph = await plannedTaskService.getGraph(threadId);
+            if (!graph)
                 return;
-            }
-            const checkpoint = action.tasks[0];
-            await plannedTaskService.markRunning(threadId, checkpoint.id, {
-                agentId: ORCHESTRATOR_AGENT_ID,
+            await this.syncPlannedTasksToUi(threadId, graph);
+            const availableSlots = Math.max(0, MAX_CONCURRENT_BACKGROUND_TASKS_PER_THREAD -
+                this.backgroundTasks.getRunningTasks(threadId).length);
+            const pendingWorkflowVerification = await this.workflowObligations.findPendingPlannedWorkflowVerification(threadId, graph);
+            const action = await plannedTaskService.tick(threadId, {
+                availableSlots,
+                pendingWorkflowVerification,
             });
-            const graphAfterMark = (await plannedTaskService.getGraph(threadId)) ?? action.graph;
-            await this.syncPlannedTasksToUi(threadId, graphAfterMark);
-            const checkpointRecord = graphAfterMark.tasks.find((t) => t.id === checkpoint.id) ?? checkpoint;
-            const startedRunId = await this.startInternalFollowUpRun(activeUser, threadId, this.buildPlannedTaskFollowUpMessage('checkpoint', graphAfterMark, {
-                checkpoint: checkpointRecord,
-            }), action.graph.messageGroupId, false, { isCheckpointFollowUp: true, checkpointTaskId: checkpoint.id });
-            if (!startedRunId) {
-                this.logger.warn('Checkpoint follow-up run did not start — reverting checkpoint to planned for retry', { threadId, checkpointTaskId: checkpoint.id });
-                await plannedTaskService.revertCheckpointToPlanned(threadId, checkpoint.id);
-            }
-            return;
-        }
-        const environment = await this.createExecutionEnvironment(activeUser, threadId, action.graph.planRunId, createInertAbortSignal(), action.graph.messageGroupId, this.threadPushRef.get(threadId));
-        environment.orchestrationContext.tracing = this.getTraceContext(action.graph.planRunId);
-        for (const task of action.tasks) {
-            await this.dispatchPlannedTask(task, environment.orchestrationContext, action.graph);
+            if (action.type === 'none')
+                return;
+            const result = await actionRunner.run(action);
+            if (result.type !== 'continue-scheduling')
+                return;
         }
-        await this.doSchedulePlannedTasks(activeUser, threadId);
     }
-    async executeRun(user, threadId, runId, message, abortController, attachments, messageGroupId, timeZone, isReplanFollowUp = false, checkpoint, resumeReason) {
+    async executeRun(user, threadId, runId, message, abortController, attachments, messageGroupId, timeZone, isReplanFollowUp = false, checkpoint, resumeReason, plannedBuild) {
         const userMessagePersistence = this.userMessagePersistenceByRun.get(runId)?.message;
         const signal = abortController.signal;
         let tracing;
@@ -2382,12 +2630,15 @@ let InstanceAiService = class InstanceAiService {
                 });
                 return;
             }
-            const mcpServers = this.parseMcpServers(this.instanceAiConfig.mcpServers);
+            const staticMcpServers = this.parseMcpServers(this.instanceAiConfig.mcpServers);
+            const registryMcpServers = await this.mcpRegistryService.getRegistryMcpServers(user);
+            const mcpServers = [...staticMcpServers, ...registryMcpServers];
             const executionPushRef = this.threadPushRef.get(threadId);
             const environment = await this.createExecutionEnvironment(user, threadId, runId, signal, messageGroupId, executionPushRef);
             activeSnapshotStorage = environment.snapshotStorage;
-            const { context, memory, taskStorage, snapshotStorage, modelId, orchestrationContext } = environment;
+            const { context, memory, taskStorage, snapshotStorage, workflowTasks, plannedTaskService, modelId, orchestrationContext, } = environment;
             aiCreatedWorkflowIds = context.aiCreatedWorkflowIds ??= new Set();
+            const isPostPlanFollowUp = isReplanFollowUp || checkpoint?.isCheckpointFollowUp === true;
             orchestrationContext.currentUserMessage = message;
             orchestrationContext.isReplanFollowUp = isReplanFollowUp;
             orchestrationContext.timeZone = timeZone ?? this.defaultTimeZone;
@@ -2398,7 +2649,39 @@ let InstanceAiService = class InstanceAiService {
                     ...context.permissions,
                     ...(instance_ai_1.PLANNED_TASK_PERMISSION_OVERRIDES.checkpoint ?? {}),
                 };
-                context.allowedRunWorkflowIds = await this.getCheckpointAllowedWorkflowIds(threadId, checkpoint.checkpointTaskId);
+                const runPolicy = await this.getCheckpointRunPolicy(threadId, checkpoint.checkpointTaskId);
+                context.allowedRunWorkflowIds = runPolicy.allowedWorkflowIds;
+                context.allowedRunWorkflowNames = runPolicy.allowedWorkflowNames;
+                context.requireRunWorkflowApproval = runPolicy.requireApproval;
+            }
+            if (plannedBuild?.isPlannedBuildFollowUp) {
+                context.permissions = {
+                    ...context.permissions,
+                    ...(instance_ai_1.PLANNED_TASK_PERMISSION_OVERRIDES['build-workflow'] ?? {}),
+                };
+                context.workflowBuildContext = {
+                    threadId,
+                    runId,
+                    taskId: plannedBuild.buildTaskId,
+                    workItemId: plannedBuild.workItemId,
+                    allowPostPlanWorkflowCreate: true,
+                    isSupportingWorkflowTask: plannedBuild.isSupportingWorkflowTask,
+                    plannedTaskService,
+                    workflowTaskService: workflowTasks,
+                    onBuildOutcome: (outcome) => {
+                        plannedBuild.savedOutcome = outcome;
+                    },
+                };
+            }
+            else {
+                context.workflowBuildContext = {
+                    threadId,
+                    runId,
+                    taskId: `build-${runId}`,
+                    workItemId: `wi_${(0, nanoid_1.nanoid)(8)}`,
+                    allowPostPlanWorkflowCreate: isPostPlanFollowUp,
+                    workflowTaskService: workflowTasks,
+                };
             }
             if (attachments && attachments.length > 0) {
                 context.currentUserAttachments = attachments;
@@ -2431,6 +2714,9 @@ let InstanceAiService = class InstanceAiService {
                         ...(checkpoint?.isCheckpointFollowUp
                             ? { checkpoint_task_id: checkpoint.checkpointTaskId }
                             : {}),
+                        ...(plannedBuild?.isPlannedBuildFollowUp
+                            ? { build_task_id: plannedBuild.buildTaskId }
+                            : {}),
                     },
                 })
                 : await (0, instance_ai_1.createInstanceAiTraceContext)({
@@ -2628,6 +2914,7 @@ let InstanceAiService = class InstanceAiService {
                         tracing,
                         modelId,
                         checkpoint,
+                        plannedBuild,
                     });
                     void this.persistPendingConfirmation({
                         requestId: result.suspension.requestId,
@@ -2715,6 +3002,8 @@ let InstanceAiService = class InstanceAiService {
                 messageGroupId,
                 correlationId: messageId,
                 workSummary: result.workSummary,
+                suppressCompletedFallback: checkpoint?.isCheckpointFollowUp === true ||
+                    plannedBuild?.isPlannedBuildFollowUp === true,
             });
             const finalStatus = result.status === 'errored' ? 'error' : result.status;
             await this.finalizeRunTracing(runId, tracing, {
@@ -2831,10 +3120,15 @@ let InstanceAiService = class InstanceAiService {
                 if (checkpoint?.isCheckpointFollowUp) {
                     await this.finalizeCheckpointFollowUp(user, threadId, checkpoint.checkpointTaskId);
                 }
+                else if (plannedBuild?.isPlannedBuildFollowUp) {
+                    await this.finalizePlannedBuildFollowUp(user, threadId, plannedBuild);
+                }
                 else {
                     await this.schedulePlannedTasks(user, threadId);
                 }
                 await this.drainPendingCheckpointReentries(user, threadId);
+                await this.taskProjector.syncFromWorkflowLoop(threadId, runId);
+                await this.maybeStartWorkflowSetupFollowUp(user, threadId);
             }
         }
     }
@@ -2944,6 +3238,42 @@ let InstanceAiService = class InstanceAiService {
         }
         await this.schedulePlannedTasks(user, threadId);
     }
+    async finalizePlannedBuildFollowUp(user, threadId, plannedBuild) {
+        try {
+            const { plannedTaskService } = await this.createPlannedTaskState();
+            const graph = await plannedTaskService.getGraph(threadId);
+            const task = graph?.tasks.find((t) => t.id === plannedBuild.buildTaskId);
+            if (task && task.status === 'running') {
+                if (plannedBuild.savedOutcome?.submitted === true) {
+                    await plannedTaskService.markSucceeded(threadId, plannedBuild.buildTaskId, {
+                        result: plannedBuild.savedOutcome.summary,
+                        outcome: plannedBuild.savedOutcome,
+                    });
+                }
+                else {
+                    this.logger.warn('Build workflow follow-up ended without saving — marking failed', {
+                        threadId,
+                        buildTaskId: plannedBuild.buildTaskId,
+                    });
+                    await plannedTaskService.markFailed(threadId, plannedBuild.buildTaskId, {
+                        error: 'Workflow build run ended without saving a workflow',
+                    });
+                }
+                const nextGraph = await plannedTaskService.getGraph(threadId);
+                if (nextGraph) {
+                    await this.syncPlannedTasksToUi(threadId, nextGraph);
+                }
+            }
+        }
+        catch (error) {
+            this.logger.error('Build workflow finalization failed', {
+                threadId,
+                buildTaskId: plannedBuild.buildTaskId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+        await this.schedulePlannedTasks(user, threadId);
+    }
     async resolveConfirmation(requestingUserId, requestId, request) {
         const data = toConfirmationData(request);
         const freshUser = await this.revalidateActiveUser(requestingUserId);
@@ -3151,7 +3481,7 @@ let InstanceAiService = class InstanceAiService {
             });
             return false;
         }
-        const { agent, runId, agentRunId, threadId, user, toolCallId, abortController, tracing, modelId, messageGroupId, checkpoint, } = suspended;
+        const { agent, runId, agentRunId, threadId, user, toolCallId, abortController, tracing, modelId, messageGroupId, checkpoint, plannedBuild, } = suspended;
         if (user.id !== requestingUserId)
             return false;
         const activeUser = await this.revalidateActiveUser(user.id);
@@ -3200,6 +3530,9 @@ let InstanceAiService = class InstanceAiService {
                 ...(checkpoint?.isCheckpointFollowUp
                     ? { checkpoint_task_id: checkpoint.checkpointTaskId }
                     : {}),
+                ...(plannedBuild?.isPlannedBuildFollowUp
+                    ? { build_task_id: plannedBuild.buildTaskId }
+                    : {}),
             },
         });
         this.startProcessResumedStream(agent, resumeData, {
@@ -3214,6 +3547,7 @@ let InstanceAiService = class InstanceAiService {
             tracing: resumeTracing ?? tracing,
             modelId,
             checkpoint,
+            plannedBuild,
         });
         return true;
     }
@@ -3284,6 +3618,7 @@ let InstanceAiService = class InstanceAiService {
                         tracing: opts.tracing,
                         ...(opts.modelId !== undefined ? { modelId: opts.modelId } : {}),
                         checkpoint: opts.checkpoint,
+                        plannedBuild: opts.plannedBuild,
                     });
                     void this.persistPendingConfirmation({
                         requestId: result.suspension.requestId,
@@ -3369,6 +3704,8 @@ let InstanceAiService = class InstanceAiService {
             this.evaluateTerminalResponse(opts.threadId, opts.runId, result.status, {
                 messageGroupId,
                 workSummary: result.workSummary,
+                suppressCompletedFallback: opts.checkpoint?.isCheckpointFollowUp === true ||
+                    opts.plannedBuild?.isPlannedBuildFollowUp === true,
             });
             const finalStatus = result.status === 'errored' ? 'error' : result.status;
             await this.finalizeRunTracing(opts.runId, opts.tracing, {
@@ -3479,10 +3816,15 @@ let InstanceAiService = class InstanceAiService {
                 if (opts.checkpoint?.isCheckpointFollowUp) {
                     await this.finalizeCheckpointFollowUp(opts.user, opts.threadId, opts.checkpoint.checkpointTaskId);
                 }
+                else if (opts.plannedBuild?.isPlannedBuildFollowUp) {
+                    await this.finalizePlannedBuildFollowUp(opts.user, opts.threadId, opts.plannedBuild);
+                }
                 else {
                     await this.schedulePlannedTasks(opts.user, opts.threadId);
                 }
                 await this.drainPendingCheckpointReentries(opts.user, opts.threadId);
+                await this.taskProjector.syncFromWorkflowLoop(opts.threadId, opts.runId);
+                await this.maybeStartWorkflowSetupFollowUp(opts.user, opts.threadId);
             }
         }
     }
@@ -3557,6 +3899,7 @@ let InstanceAiService = class InstanceAiService {
                 await this.saveAgentTreeSnapshot(opts.threadId, runId, snapshotStorage, true, task.messageGroupId);
                 if (task.plannedTaskId)
                     return;
+                await this.taskProjector.syncFromBackgroundTask(task);
                 const parentCheckpointId = task.parentCheckpointId;
                 if (parentCheckpointId) {
                     const user = this.runState.getThreadUser(opts.threadId);
@@ -3583,6 +3926,12 @@ let InstanceAiService = class InstanceAiService {
                     }
                     const user = this.runState.getThreadUser(opts.threadId);
                     if (user) {
+                        const verificationFollowUpStarted = await this.maybeStartWorkflowVerificationFollowUp(user, task);
+                        if (verificationFollowUpStarted)
+                            return;
+                        const setupFollowUpStarted = await this.maybeStartWorkflowSetupFollowUp(user, task.threadId);
+                        if (setupFollowUpStarted)
+                            return;
                         const payload = JSON.stringify({
                             role: opts.role,
                             status: task.result ? 'completed' : task.error ? 'failed' : 'finished',
@@ -3596,6 +3945,7 @@ let InstanceAiService = class InstanceAiService {
             },
         });
         if (outcome.status === 'started') {
+            void this.taskProjector.syncFromBackgroundTask(outcome.task);
             return { status: 'started', taskId: outcome.task.taskId, agentId: outcome.task.agentId };
         }
         if (outcome.status === 'duplicate') {
@@ -4026,6 +4376,8 @@ exports.InstanceAiService = InstanceAiService = __decorate([
         instance_ai_adapter_service_1.InstanceAiAdapterService,
         in_process_event_bus_1.InProcessEventBus,
         instance_ai_settings_service_1.InstanceAiSettingsService,
+        instance_ai_gateway_service_1.InstanceAiGatewayService,
+        instance_ai_memory_service_1.InstanceAiMemoryService,
         typeorm_agent_memory_1.TypeORMAgentMemory,
         typeorm_agent_checkpoint_store_1.TypeORMAgentCheckpointStore,
         ai_service_1.AiService,
@@ -4037,11 +4389,12 @@ exports.InstanceAiService = InstanceAiService = __decorate([
         db_iteration_log_storage_1.DbIterationLogStorage,
         source_control_preferences_service_ee_1.SourceControlPreferencesService,
         telemetry_1.Telemetry,
+        mcp_1.InstanceAiMcpRegistryService,
         db_1.UserRepository,
         db_1.AiBuilderTemporaryWorkflowRepository,
         n8n_core_1.ErrorReporter,
         config_1.SsrfProtectionConfig,
-        ssrf_protection_service_1.SsrfProtectionService,
+        n8n_core_1.SsrfProtectionService,
         event_service_1.EventService])
 ], InstanceAiService);
 //# sourceMappingURL=instance-ai.service.js.map