feat: enhance command classification and error handling; improve process checks and credential security

src/app/workflow/engine.rs

@@ -110,13 +110,22 @@ pub fn execute_primitive(
     primitive: &ScriptPrimitive,
     args: &HashMap<String, String>,
     concurrency_cap: usize,
+    continue_on_error: bool,
 ) -> anyhow::Result<Vec<String>> {
     match primitive {
         ScriptPrimitive::Agent(prompt) => {
             let resolved = resolve_template(prompt, args);
             let findings_snapshot = FINDINGS.lock().map(|f| f.clone()).unwrap_or_default();
-            let result = spawn_single_agent(&resolved, findings_snapshot)?;
-            Ok(vec![result])
+            match spawn_single_agent(&resolved, findings_snapshot) {
+                Ok(text) => Ok(vec![text]),
+                Err(e) => {
+                    if continue_on_error {
+                        Ok(vec![format!("agent error: {}", e)])
+                    } else {
+                        Err(e)
+                    }
+                }
+            }
         }
 
         ScriptPrimitive::Parallel(scripts) => {
@@ -136,7 +145,7 @@ pub fn execute_primitive(
 
                     std::thread::spawn(move || {
                         let _permit = sem.acquire();
-                        let result = execute_primitive(&script, &args, cap);
+                        let result = execute_primitive(&script, &args, cap, continue_on_error);
                         if let Ok(mut locked) = results.lock() {
                             locked.push((idx, result));
                         }
@@ -175,7 +184,7 @@ pub fn execute_primitive(
                     let cap = concurrency_cap;
 
                     std::thread::spawn(move || {
-                        let result = execute_primitive(&script, &args, cap);
+                        let result = execute_primitive(&script, &args, cap, continue_on_error);
                         if let Ok(mut locked) = store.lock() {
                             locked[idx] = Some(result.unwrap_or_else(|e| vec![format!("pipeline stage {} error: {}", idx, e)]));
                         }
@@ -196,7 +205,7 @@ pub fn execute_primitive(
         }
 
         ScriptPrimitive::Phase { name: _name, script } => {
-            execute_primitive(script, args, concurrency_cap)
+            execute_primitive(script, args, concurrency_cap, continue_on_error)
         }
     }
 }
@@ -220,7 +229,7 @@ pub fn run_workflow(script: &WorkflowScript, args: &HashMap<String, String>) ->
         5
     };
 
-    let results = execute_primitive(&script.script, args, concurrency_cap)?;
+    let results = execute_primitive(&script.script, args, concurrency_cap, script.options.continue_on_error)?;
 
     let summary = if results.is_empty() {
         "workflow completed with no output".to_string()