From 2e5eb4f8c5b6a8922ec34cc211c4d4e1d368ddf2 Mon Sep 17 00:00:00 2001
From: Cyrus Gray <144336577+graycyrus@users.noreply.github.com>
Date: Wed, 8 Jul 2026 19:22:33 +0530
Subject: [PATCH] fix(flows): normalize bare-scope jq in condition expressions
 + prompt guard (B17) (#4707)

---
 src/openhuman/flows/agents/workflow_builder/prompt.md | 8 ++++++++
 vendor/tinyflows                                      | 2 +-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/openhuman/flows/agents/workflow_builder/prompt.md b/src/openhuman/flows/agents/workflow_builder/prompt.md
index 4d5c5c715..a9805b4f0 100644
--- a/src/openhuman/flows/agents/workflow_builder/prompt.md
+++ b/src/openhuman/flows/agents/workflow_builder/prompt.md
@@ -307,6 +307,14 @@ the run scope (`.`):
   the first output is used; a bad program yields `null` (never an error).
 - A string **without** a leading `=` is a literal. To emit a literal `=`, don't
   start the string with it.
+- **Never mix the shorthand with jq.** If an expression **begins with a bare
+  scope key** (`item`/`items`/`run`/`nodes`) and continues into jq syntax —
+  `|`, `[`, functions (`any(...)`, `length`), or anything beyond a plain
+  dotted path — it MUST start with `.` instead (the jq root): write
+  `"=.item.labels | any(.name==\"x\")"`, NOT `"=item.labels | any(...)"`. The
+  plain shorthand `"=item.labels"` (no jq) is fine alone. Expressions that
+  already start with valid jq syntax (e.g. `"=[.item.a, .item.b]"` for array
+  construction) don't need an extra leading dot — only bare scope keys do.
 
 The scope exposes:
 
diff --git a/vendor/tinyflows b/vendor/tinyflows
index 56d81dfda..68590ed32 160000
--- a/vendor/tinyflows
+++ b/vendor/tinyflows
@@ -1 +1 @@
-Subproject commit 56d81dfdadc1454189322d744e050ae4f7e525f9
+Subproject commit 68590ed32e2450c62dbdb9d2ff5a0178e00c22ea