feat: RAW_OUTPUT passthrough for DSL output() through workflow chain

When execute_plan uses output(), the data must reach the end user
without any intermediate LLM rewriting it. This commit implements
the full passthrough chain:

- parseAIResponse: extract <<<RAW_OUTPUT>>> blocks before JSON parsing,
  attach as _rawOutput on the parsed output object
- workflow-check-provider: propagate _rawOutput from step outputs to
  workflow-level output
- workflow-tool-executor: wrap _rawOutput in <<<RAW_OUTPUT>>> delimiters
  when returning tool result, so the calling ProbeAgent extracts it
  via extractRawOutputBlocks (bypassing the LLM)
- slack-frontend: append _rawOutput to rendered text so file sections
  (--- filename.ext ---) get extracted and uploaded

Also updates @probelabs/probe to 0.6.0-rc245 which includes the
ProbeAgent-side change (appending output buffer with RAW_OUTPUT
delimiters for schema responses).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: buger

package-lock.json

@@ -102,7 +102,7 @@
     "@octokit/auth-app": "^8.1.0",
     "@octokit/core": "^7.0.3",
     "@octokit/rest": "^22.0.0",
-    "@probelabs/probe": "^0.6.0-rc240",
+    "@probelabs/probe": "^0.6.0-rc245",
     "@types/commander": "^2.12.0",
     "@types/uuid": "^10.0.0",
     "ajv": "^8.17.1",

package.json

@@ -2438,6 +2438,26 @@ ${'='.repeat(60)}
       // Handle different schema types differently
       let reviewData: AIResponseFormat = undefined as unknown as AIResponseFormat;
 
+      // Extract <<<RAW_OUTPUT>>> blocks appended by ProbeAgent after schema JSON.
+      // These carry DSL output() content that must bypass LLM rewriting and be
+      // propagated directly to the user (Slack, CLI, etc.).
+      // Declared here so it's accessible across all parsing paths below.
+      const RAW_OUTPUT_RE = /\n<<<RAW_OUTPUT>>>\n([\s\S]*?)\n<<<END_RAW_OUTPUT>>>/g;
+      const rawOutputBlocks: string[] = [];
+      let responseForParsing = response;
+      {
+        let rawMatch: RegExpExecArray | null;
+        while ((rawMatch = RAW_OUTPUT_RE.exec(response)) !== null) {
+          rawOutputBlocks.push(rawMatch[1]);
+        }
+        if (rawOutputBlocks.length > 0) {
+          responseForParsing = response.replace(RAW_OUTPUT_RE, '');
+          log(
+            `📦 Extracted ${rawOutputBlocks.length} RAW_OUTPUT blocks (${rawOutputBlocks.reduce((s, b) => s + b.length, 0)} chars) from response`
+          );
+        }
+      }
+
       // Handle plain schema or no schema - no JSON parsing, treat as assistant-style text output
       if (_schema === 'plain' || !_schema) {
         log(
@@ -2465,7 +2485,7 @@ ${'='.repeat(60)}
 
         // Sanitize response: strip BOM, zero-width chars, and other invisible characters
         // that can cause JSON parsing to fail even when the text looks valid
-        const sanitizedResponse = response
+        const sanitizedResponse = responseForParsing
           .replace(/^\uFEFF/, '') // BOM
           .replace(/[\u200B-\u200D\uFEFF\u00A0]/g, '') // Zero-width chars, NBSP
           .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '') // Control chars (except \t \n \r)
@@ -2522,10 +2542,12 @@ ${'='.repeat(60)}
               response.toLowerCase().includes('unable to')
             ) {
               console.error('🚫 AI refused to analyze - returning refusal as output');
-              const trimmed = response.trim();
+              const trimmed = responseForParsing.trim();
+              const out: any = trimmed ? { text: trimmed } : {};
+              if (rawOutputBlocks.length > 0) out._rawOutput = rawOutputBlocks.join('\n\n');
               return {
                 issues: [],
-                output: trimmed ? { text: trimmed } : {},
+                output: out,
                 debug: debugInfo,
               };
             }
@@ -2534,10 +2556,12 @@ ${'='.repeat(60)}
             // This allows Probe (or other AI providers) to handle JSON validation
             // and avoids false positives from bracket-matching (e.g., mermaid diagrams)
             log('🔧 Treating response as plain text (no JSON extraction)');
-            const trimmed = response.trim();
+            const trimmed = responseForParsing.trim();
+            const fallbackOut: any = { text: trimmed };
+            if (rawOutputBlocks.length > 0) fallbackOut._rawOutput = rawOutputBlocks.join('\n\n');
             return {
               issues: [],
-              output: { text: trimmed },
+              output: fallbackOut,
               debug: debugInfo,
             };
           }
@@ -2627,6 +2651,11 @@ ${'='.repeat(60)}
           }
         }
 
+        // Attach raw output blocks from DSL execute_plan so frontends can render them
+        if (rawOutputBlocks.length > 0) {
+          (out as any)._rawOutput = rawOutputBlocks.join('\n\n');
+        }
+
         const result: ReviewSummary & { output?: unknown } = {
           // Keep issues empty for custom-schema rendering; consumers read from output.*
           issues: [],

src/ai-review-service.ts

@@ -529,6 +529,11 @@ export class SlackFrontend implements Frontend {
           text = String(out);
         }
       }
+      // Append raw output from DSL execute_plan (bypasses LLM rewriting chain)
+      if (out && typeof out._rawOutput === 'string' && out._rawOutput.trim().length > 0) {
+        text = (text || '') + '\n\n' + out._rawOutput.trim();
+      }
+
       if (!text) {
         ctx.logger.info(
           `[slack-frontend] skip posting AI reply for ${checkId}: no renderable text in check output`

src/frontends/slack-frontend.ts

@@ -866,6 +866,27 @@ export class WorkflowCheckProvider extends CheckProvider {
       );
     }
 
+    // Propagate _rawOutput from any step — this carries DSL output() content
+    // that must bypass all LLM processing and reach the end user directly.
+    if (!(outputs as any)._rawOutput) {
+      const rawParts: string[] = [];
+      for (const stepOutput of Object.values(outputsMap)) {
+        if (
+          stepOutput &&
+          typeof stepOutput === 'object' &&
+          typeof (stepOutput as any)._rawOutput === 'string'
+        ) {
+          rawParts.push((stepOutput as any)._rawOutput);
+        }
+      }
+      if (rawParts.length > 0) {
+        (outputs as any)._rawOutput = rawParts.join('\n\n');
+        logger.debug(
+          `[WorkflowProvider] Propagated _rawOutput from steps (${rawParts.length} blocks, ${(outputs as any)._rawOutput.length} chars)`
+        );
+      }
+    }
+
     return outputs;
   }
 

src/providers/workflow-check-provider.ts

@@ -243,6 +243,20 @@ export async function executeWorkflowAsTool(
   logger.debug(`[WorkflowToolExecutor] Workflow '${workflowId}' output preview: ${outputPreview}`);
 
   if (output !== undefined) {
+    // If the workflow output carries _rawOutput (from DSL execute_plan output()),
+    // extract it and wrap in <<<RAW_OUTPUT>>> delimiters so the calling ProbeAgent
+    // can extract it via extractRawOutputBlocks before the LLM sees the tool result.
+    // This ensures raw data passes through the full chain without any LLM touching it.
+    if (output && typeof output === 'object' && typeof (output as any)._rawOutput === 'string') {
+      const rawOutput = (output as any)._rawOutput;
+      const cleanOutput = { ...output };
+      delete (cleanOutput as any)._rawOutput;
+      const jsonStr = JSON.stringify(cleanOutput, null, 2);
+      logger.debug(
+        `[WorkflowToolExecutor] Wrapping _rawOutput (${rawOutput.length} chars) in RAW_OUTPUT delimiters for '${workflowId}'`
+      );
+      return jsonStr + '\n<<<RAW_OUTPUT>>>\n' + rawOutput + '\n<<<END_RAW_OUTPUT>>>';
+    }
     return output;
   }