fix(workflows): close review gaps for save, replay, and telemetry

Reject brittle wait_for_element selectors and weak semantic targets at
compile/normalize time, redact clarify/submit payloads during replay,
rewrite parameter markers in fallback prompts, align replay cleanup with
processMessage, and map remaining save-failure reasons in the UI.

Author: esokullu

src/chrome/src/agent/agent.js

@@ -50,6 +50,7 @@ import {
   findWorkflowTarget,
   parseAccessibilityTreeDescriptors,
   redactWorkflowArgsForTelemetry,
+  redactWorkflowClarifyForTelemetry,
   redactWorkflowResultForTelemetry,
   resolveWorkflowArgs,
   validateWorkflowStepResult,
@@ -12193,7 +12194,12 @@ Rules: no prose intro, no conclusion, no "this screenshot shows...", no layout d
       throw new Error('Saved workflow is missing or invalid.');
     }
     await this._hydrate(tabId);
+    // Align pre-run cleanup with processMessage so a prior Act turn cannot
+    // leak click-AX CDP fallbacks, plan guards, or active-skill state into
+    // deterministic replay (or the reverse on the next turn).
+    this._resetActiveSkillsForRun(tabId, { refreshPrompt: false });
     this._clearRunLoopState(tabId);
+    this._clickAxCdpFallbacks?.delete(tabId);
     this.abortFlags.delete(tabId);
     this._prepareClarificationAuthorizationForRun(tabId);
     this.permissions.beginTurn(tabId);
@@ -12315,7 +12321,11 @@ Rules: no prose intro, no conclusion, no "this screenshot shows...", no layout d
             onUpdate(type, { ...data, result: redactWorkflowResultForTelemetry(step.tool, data.result), workflowReplay: true });
             return;
           }
-          onUpdate(type, data);
+          if (type === 'clarify') {
+            onUpdate(type, redactWorkflowClarifyForTelemetry(data));
+            return;
+          }
+          onUpdate(type, { ...(data && typeof data === 'object' ? data : {}), workflowReplay: true });
         };
         const beforeUrl = stepUrl;
         const batch = await this._executeToolBatch(
@@ -12374,8 +12384,12 @@ Rules: no prose intro, no conclusion, no "this screenshot shows...", no layout d
       return { status: 'completed', summary, matchedSteps, estimatedLlmCallsSaved: matchedSteps };
     } finally {
       await trace.endRun(traceRunId, { status: traceStatus, finalContent });
+      this.currentCostState.delete(tabId);
+      this._planExecutionGuards.delete(tabId);
+      this._resetActiveSkillsForRun(tabId);
       this._runningTabs.delete(tabId);
       this._clearRunLoopState(tabId);
+      this._clickAxCdpFallbacks?.delete(tabId);
       this._clearCompletionInvariant(tabId, completionRunToken);
     }
   }

src/chrome/src/agent/workflows.js

@@ -17,6 +17,9 @@ const MAX_WORKFLOWS = 100;
 const MAX_STEPS = 100;
 const MAX_PARAMETERS = 50;
 const MAX_TEXT = 240;
+// findWorkflowTarget and compile-time strength checks share this floor so a
+// saved target that can never match uniquely is rejected at save time.
+export const WORKFLOW_TARGET_MATCH_THRESHOLD = 7;
 
 export const REPLAYABLE_WORKFLOW_TOOLS = new Set([
   'navigate',
@@ -244,12 +247,14 @@ function compileStepArgs(name, rawArgs, target, parameters, warnings) {
     return { url };
   }
   if (name === 'go_back' || name === 'go_forward') return {};
-  if (name === 'click_ax') return target ? {} : null;
+  if (name === 'click_ax') return isReplayableWorkflowTarget(target) ? {} : null;
   if (name === 'set_checked') {
-    return target && typeof args.checked === 'boolean' ? { checked: args.checked } : null;
+    return isReplayableWorkflowTarget(target) && typeof args.checked === 'boolean'
+      ? { checked: args.checked }
+      : null;
   }
   if (name === 'type_ax' || name === 'set_field') {
-    if (!target || parameters.length >= MAX_PARAMETERS) return null;
+    if (!isReplayableWorkflowTarget(target) || parameters.length >= MAX_PARAMETERS) return null;
     const base = parameterBase(target, `input_${parameters.length + 1}`);
     const id = uniqueParameterId(base, parameters);
     parameters.push({
@@ -284,13 +289,13 @@ function compileStepArgs(name, rawArgs, target, parameters, warnings) {
     };
   }
   if (name === 'wait_for_element') {
-    const selector = cleanText(args.selector);
+    // Same fail-closed rule as click: bare CSS selectors are brittle across
+    // layout changes and must not be stored for deterministic replay.
     const text = cleanText(args.text);
     const timeout = Number(args.timeout);
-    if (!selector && !text) return null;
+    if (!text) return null;
     return {
-      ...(selector ? { selector } : {}),
-      ...(text ? { text } : {}),
+      text,
       ...(Number.isFinite(timeout) ? { timeout: Math.max(100, Math.min(30000, Math.round(timeout))) } : {}),
     };
   }
@@ -456,10 +461,22 @@ export function normalizeSavedWorkflow(input, options = {}) {
       if (!text) continue;
       args = { text };
     }
+    if (tool === 'wait_for_element') {
+      const text = cleanText(args.text);
+      if (!text) continue;
+      const timeout = Number(args.timeout);
+      args = {
+        text,
+        ...(Number.isFinite(timeout) ? { timeout: Math.max(100, Math.min(30000, Math.round(timeout))) } : {}),
+      };
+    }
     if ((tool === 'type_ax' || tool === 'set_field') && !args.text?.[WORKFLOW_PARAM_REF_KEY]) continue;
     const target = normalizeTarget(raw?.target);
     const scope = normalizeWorkflowScope(raw?.scope);
-    if (['click_ax', 'set_checked', 'type_ax', 'set_field'].includes(tool) && !target) continue;
+    if (['click_ax', 'set_checked', 'type_ax', 'set_field'].includes(tool)
+        && !isReplayableWorkflowTarget(target)) {
+      continue;
+    }
     steps.push({
       id: cleanId(raw?.id, `step_${steps.length + 1}`),
       tool,
@@ -563,6 +580,53 @@ export function redactWorkflowResultForTelemetry(tool, result) {
   return redact(result);
 }
 
+function redactWorkflowSubmitField(field) {
+  if (!field || typeof field !== 'object') return field;
+  const out = { ...field };
+  for (const key of ['value', 'text', 'actual', 'currentValue', 'newValue', 'oldValue']) {
+    if (Object.hasOwn(out, key) && out[key] != null && out[key] !== '') {
+      out[key] = '[workflow parameter redacted]';
+    }
+  }
+  return out;
+}
+
+/**
+ * Submit-confirmation and similar clarify events can carry live form field
+ * values that were just typed as workflow parameters. Keep host/tool labels
+ * for the user prompt, but strip values and free-text summaries from UI
+ * telemetry during replay.
+ */
+export function redactWorkflowClarifyForTelemetry(data = {}) {
+  const out = { ...(data && typeof data === 'object' ? data : {}), workflowReplay: true };
+  if (out.submitConfirmation && typeof out.submitConfirmation === 'object') {
+    const sc = { ...out.submitConfirmation };
+    if (sc.summary) sc.summary = '[workflow form summary redacted]';
+    if (Array.isArray(sc.fields)) sc.fields = sc.fields.map(redactWorkflowSubmitField);
+    if (Array.isArray(sc.changedFields)) {
+      sc.changedFields = sc.changedFields.map(redactWorkflowSubmitField);
+    }
+    out.submitConfirmation = sc;
+  }
+  return out;
+}
+
+function rewriteWorkflowArgsForFallback(args) {
+  const rewrite = (value, depth = 0) => {
+    if (depth > 6) return value;
+    if (Array.isArray(value)) return value.map((item) => rewrite(item, depth + 1));
+    if (!value || typeof value !== 'object') return value;
+    if (Object.keys(value).length === 1 && Object.hasOwn(value, WORKFLOW_PARAM_REF_KEY)) {
+      const id = cleanId(value[WORKFLOW_PARAM_REF_KEY], 'value');
+      return `<ask user for parameter: ${id}>`;
+    }
+    return Object.fromEntries(
+      Object.entries(value).map(([key, item]) => [key, rewrite(item, depth + 1)]),
+    );
+  };
+  return rewrite(args || {});
+}
+
 export function validateWorkflowStepResult(expected, result, context = {}) {
   if (!result || typeof result !== 'object') {
     return { ok: false, reason: 'missing_result', outcomeUnknown: true };
@@ -600,7 +664,9 @@ export function workflowFallbackPrompt(workflow, failedStepIndex, reason = 'targ
   const remaining = (workflow?.steps || []).slice(index).map((step) => ({
     tool: step.tool,
     target: step.target || null,
-    args: step.args || {},
+    // Rewrite internal $workflowParam markers so local models do not treat
+    // the object shape as literal type_ax / set_field text.
+    args: rewriteWorkflowArgsForFallback(step.args || {}),
     expected: step.expected || null,
   }));
   const parameters = (workflow?.parameters || []).map((parameter) => ({
@@ -636,16 +702,21 @@ export function scoreWorkflowTarget(target, candidate) {
   addExact('name', 7);
   addExact('href', 7);
   addExact('placeholder', 5);
-  addExact('selector', 5);
+  // selector is intentionally not scored: TARGET_FIELDS never stores it, and
+  // brittle CSS evidence must not count toward a deterministic match.
   addExact('type', 3);
   addExact('role', 2);
   return score;
 }
 
+export function isReplayableWorkflowTarget(target) {
+  return scoreWorkflowTarget(target, target) >= WORKFLOW_TARGET_MATCH_THRESHOLD;
+}
+
 export function findWorkflowTarget(target, candidates) {
   const ranked = (Array.isArray(candidates) ? candidates : [])
     .map((candidate) => ({ candidate, score: scoreWorkflowTarget(target, candidate) }))
-    .filter((entry) => entry.score >= 7)
+    .filter((entry) => entry.score >= WORKFLOW_TARGET_MATCH_THRESHOLD)
     .sort((a, b) => b.score - a.score);
   if (!ranked.length) return { status: 'miss', candidate: null, score: 0 };
   if (ranked[1] && ranked[1].score === ranked[0].score) {

src/chrome/src/ui/locales/ar.js

@@ -748,6 +748,9 @@ export default {
   "sp.workflows.reason.no_steps": "لا يحتوي هذا التشغيل على إجراءات يمكن حفظها بأمان لإعادة التشغيل.",
   "sp.workflows.reason.not_found": "لا توجد مهمة سير عمل محفوظة بهذا المعرّف.",
 
+  "sp.workflows.reason.name_required": "قدّم اسمًا لسير العمل: /workflow --save <name>.",
+  "sp.workflows.reason.http_start_url": "يجب أن يبدأ التشغيل المسجل على صفحة http(s) قبل حفظه.",
+  "sp.workflows.reason.normalization_failed": "تعذّر حفظ سير العمل لأن خطواته غير آمنة لإعادة التشغيل.",
   "st.tab.memory": "الذاكرة",
   "st.display.plan_review.label": "توقفات مراجعة الخطة",
   "st.display.plan_review.desc": "اختر متى تتوقف الخطة الصالحة للموافقة عليها. افتراضيًا، تتوقف فقط عندما يبلّغ المخطِّط عن ثقة أقل من الحد.",

src/chrome/src/ui/locales/en.js

@@ -339,6 +339,9 @@ export default {
   'sp.workflows.reason.no_trace': 'No successful recorded run was found in this conversation. Enable tracing, complete the task, then save it.',
   'sp.workflows.reason.no_steps': 'That run has no actions that can be safely saved for replay.',
   'sp.workflows.reason.not_found': 'No saved workflow has that ID.',
+  'sp.workflows.reason.name_required': 'Provide a workflow name: /workflow --save <name>.',
+  'sp.workflows.reason.http_start_url': 'The recorded run must start on an http(s) page before it can be saved.',
+  'sp.workflows.reason.normalization_failed': 'That workflow could not be saved because its steps were not safe to replay.',
 
   // --- Tool labels -------------------------------------------------------
   'tool.read_page': 'Reading page',

src/chrome/src/ui/locales/es.js

@@ -748,6 +748,9 @@ export default {
   "sp.workflows.reason.no_steps": "Esa ejecución no contiene acciones que puedan guardarse de forma segura.",
   "sp.workflows.reason.not_found": "No existe un flujo de trabajo guardado con ese ID.",
 
+  "sp.workflows.reason.name_required": "Indica un nombre de flujo: /workflow --save <name>.",
+  "sp.workflows.reason.http_start_url": "La ejecución registrada debe empezar en una página http(s) para poder guardarla.",
+  "sp.workflows.reason.normalization_failed": "No se pudo guardar ese flujo porque sus pasos no son seguros para repetir.",
   "st.tab.memory": "Memoria",
   "st.display.plan_review.label": "Pausas de revisión del plan",
   "st.display.plan_review.desc": "Elige cuándo un plan válido se detiene para pedir aprobación. De forma predeterminada, solo se detiene cuando el planificador indica una confianza inferior al umbral.",

src/chrome/src/ui/locales/fr.js

@@ -748,6 +748,9 @@ export default {
   "sp.workflows.reason.no_steps": "Cette exécution ne contient aucune action pouvant être enregistrée de manière sûre.",
   "sp.workflows.reason.not_found": "Aucun workflow enregistré ne possède cet ID.",
 
+  "sp.workflows.reason.name_required": "Indiquez un nom de workflow : /workflow --save <name>.",
+  "sp.workflows.reason.http_start_url": "L’exécution enregistrée doit commencer sur une page http(s) avant d’être sauvegardée.",
+  "sp.workflows.reason.normalization_failed": "Ce workflow n’a pas pu être enregistré car ses étapes ne sont pas sûres à rejouer.",
   "st.tab.memory": "Mémoire",
   "st.display.plan_review.label": "Arrêts pour révision du plan",
   "st.display.plan_review.desc": "Choisissez quand un plan valide doit s’arrêter pour approbation. Par défaut, il ne s’arrête que lorsque le planificateur indique une confiance inférieure au seuil.",

src/chrome/src/ui/locales/he.js

@@ -393,6 +393,9 @@ export default {
   "sp.workflows.reason.no_steps": "בהרצה זו אין פעולות שניתן לשמור בבטחה להפעלה חוזרת.",
   "sp.workflows.reason.not_found": "אין תהליך עבודה שמור עם מזהה זה.",
 
+  "sp.workflows.reason.name_required": "ספקו שם לתהליך העבודה: /workflow --save <name>.",
+  "sp.workflows.reason.http_start_url": "ההרצה המוקלטת חייבת להתחיל בעמוד http(s) לפני שניתן לשמור אותה.",
+  "sp.workflows.reason.normalization_failed": "לא ניתן לשמור את תהליך העבודה כי השלבים שלו אינם בטוחים להפעלה חוזרת.",
   "st.tab.memory": "זיכרון",
   "st.tab.profile": "פרופיל",
   "st.tab.account": "חשבון",

src/chrome/src/ui/locales/id.js

@@ -748,6 +748,9 @@ export default {
   "sp.workflows.reason.no_steps": "Proses tersebut tidak memiliki tindakan yang aman untuk disimpan dan dijalankan ulang.",
   "sp.workflows.reason.not_found": "Tidak ada alur kerja tersimpan dengan ID tersebut.",
 
+  "sp.workflows.reason.name_required": "Berikan nama alur kerja: /workflow --save <name>.",
+  "sp.workflows.reason.http_start_url": "Proses yang direkam harus dimulai di halaman http(s) sebelum disimpan.",
+  "sp.workflows.reason.normalization_failed": "Alur kerja itu tidak dapat disimpan karena langkahnya tidak aman untuk dijalankan ulang.",
   "st.tab.memory": "Memori",
   "st.display.plan_review.label": "Jeda peninjauan rencana",
   "st.display.plan_review.desc": "Pilih kapan rencana yang valid dijeda untuk persetujuan. Secara default, rencana hanya dijeda ketika perencana melaporkan keyakinan di bawah ambang.",

src/chrome/src/ui/locales/ja.js

@@ -748,6 +748,9 @@ export default {
   "sp.workflows.reason.no_steps": "この実行には安全に保存して再実行できる操作がありません。",
   "sp.workflows.reason.not_found": "そのIDの保存済みワークフローはありません。",
 
+  "sp.workflows.reason.name_required": "ワークフロー名を指定してください: /workflow --save <name>。",
+  "sp.workflows.reason.http_start_url": "保存する前に、記録済み実行は http(s) ページで開始している必要があります。",
+  "sp.workflows.reason.normalization_failed": "再生に安全でないステップがあるため、そのワークフローは保存できませんでした。",
   "st.tab.memory": "メモリ",
   "st.display.plan_review.label": "プランレビューの停止条件",
   "st.display.plan_review.desc": "有効なプランを承認待ちで停止する条件を選択します。既定では、プランナーが報告した信頼度がしきい値未満の場合のみ停止します。",

src/chrome/src/ui/locales/ko.js

@@ -748,6 +748,9 @@ export default {
   "sp.workflows.reason.no_steps": "이 실행에는 안전하게 저장하여 다시 실행할 수 있는 동작이 없습니다.",
   "sp.workflows.reason.not_found": "해당 ID의 저장된 워크플로가 없습니다.",
 
+  "sp.workflows.reason.name_required": "워크플로 이름을 입력하세요: /workflow --save <name>.",
+  "sp.workflows.reason.http_start_url": "저장하려면 기록된 실행이 http(s) 페이지에서 시작해야 합니다.",
+  "sp.workflows.reason.normalization_failed": "재생하기에 안전하지 않은 단계가 있어 해당 워크플로를 저장할 수 없습니다.",
   "st.tab.memory": "메모리",
   "st.display.plan_review.label": "계획 검토 중지 조건",
   "st.display.plan_review.desc": "유효한 계획이 언제 승인을 위해 멈출지 선택합니다. 기본적으로 플래너가 보고한 신뢰도가 임계값보다 낮을 때만 멈춥니다.",