Workflow tool: permission-approval schema validation rejects a clean script with "control characters that would be hidden in the approval dialog"

Workflow tool: permission-approval schema validation rejects a clean script with "control characters that would be hidden in the approval dialog"

What happened

Calling the Workflow tool — both by name ({ name: "heal-pr", args: {...} }) and by explicit file path ({ scriptPath: "<path>/heal-pr.js", args: {...} }) — fails before the workflow ever starts, with:

The permission handler returned updatedInput for Workflow that failed schema validation: [
  {
    "code": "custom",
    "path": ["script"],
    "message": "script contains control characters that would be hidden in the approval dialog"
  }
]
This is a configuration issue in your canUseTool callback, PermissionRequest hook, or
permission-prompt tool — updatedInput must satisfy the tool's input schema. The tool input
from the model was valid.

Both invocations failed identically.

Confirmed NOT the cause

• The target script (.claude/workflows/heal-pr.js, 7628 chars) contains zero control characters outside \n/\r/\t, and no BOM — checked programmatically (Node, scanning every code point).
• The repo's .claude/settings.json defines no custom permission hook, canUseTool callback, or permission-prompt tool for the Workflow tool — only a PreToolUse hook on Bash (an unrelated shell-command guard script).

So the script content is clean and there's no repo-level permission customization in play. The failure appears to originate in the harness's own built-in permission-approval rendering/validation path for the Workflow tool.

Environment

• Claude Code CLI, Windows 11, PowerShell 5.1 primary shell / Git Bash tool available.
• Repro is a predefined .claude/workflows/*.js script (structure: export const meta = {...} header + agent()/parallel() body), invoked via both the name and scriptPath parameters of the Workflow tool.

Impact

Any named or path-based Workflow invocation in this session/repo fails at the permission-approval step, regardless of script content, making the Workflow tool (and any skill/doctrine that depends on it, e.g. this repo's /heal-pr) unusable until the underlying validation bug is fixed.

Ask

Could someone look at what the permission-approval handler does to the script field before schema-validating updatedInput — the error suggests it's inserting or receiving control characters somewhere in that path (e.g. ANSI codes from a captured terminal preview, an internal wrapping/templating step) rather than the model's original script actually containing any.