fix: filter aw_context from user-facing workflow inputs

pkg/cli/run_workflow_validation.go

@@ -147,7 +147,13 @@ func getWorkflowInputs(markdownPath string) (map[string]*workflow.InputDefinitio
 	}
 
 	// Parse input definitions
-	return workflow.ParseInputDefinitions(inputsMap), nil
+	parsed := workflow.ParseInputDefinitions(inputsMap)
+
+	// Remove aw_context from the returned inputs - it is an internal input managed by the
+	// agentic workflow system and should never be surfaced to users for prompting or display.
+	delete(parsed, workflow.AwContextInputName)
+
+	return parsed, nil
 }
 
 // validateWorkflowInputs validates that required inputs are provided and checks for typos.

pkg/cli/run_workflow_validation_test.go

@@ -199,6 +199,59 @@ jobs:
 			},
 			expectError: false,
 		},
+		{
+			name:         "workflow with aw_context input is filtered out",
+			markdownFile: "compiled-workflow.md",
+			lockFileYAML: `name: "Compiled Workflow"
+on:
+  workflow_dispatch:
+    inputs:
+      aw_context:
+        default: ""
+        description: Agent caller context (used internally by Agentic Workflows).
+        required: false
+        type: string
+      task:
+        description: 'Task description'
+        required: true
+        type: string
+permissions:
+  contents: read
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "test"
+`,
+			expectedCount: 1, // aw_context should be filtered out, only 'task' remains
+			expectedReq: map[string]bool{
+				"task": true,
+			},
+			expectError: false,
+		},
+		{
+			name:         "workflow with only aw_context input returns empty",
+			markdownFile: "aw-context-only.md",
+			lockFileYAML: `name: "AW Context Only"
+on:
+  workflow_dispatch:
+    inputs:
+      aw_context:
+        default: ""
+        description: Agent caller context (used internally by Agentic Workflows).
+        required: false
+        type: string
+permissions:
+  contents: read
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "test"
+`,
+			expectedCount: 0, // aw_context is the only input and should be filtered out
+			expectError:   false,
+		},
 		{
 			name:         "workflow with no inputs",
 			markdownFile: "simple-workflow.md",

pkg/workflow/compiler_aw_context.go

@@ -8,6 +8,10 @@ import (
 
 var awContextLog = logger.New("workflow:compiler_aw_context")
 
+// AwContextInputName is the name of the internal aw_context workflow_dispatch input.
+// It is managed internally by the agentic workflow system and should not be surfaced to users.
+const AwContextInputName = "aw_context"
+
 // awContextInputDescription is the description for the aw_context workflow_dispatch input.
 // It signals to users that this input is managed internally by the agentic workflow system.
 const awContextInputDescription = "Agent caller context (used internally by Agentic Workflows)."
@@ -27,7 +31,7 @@ func injectAwContextIntoOnYAML(onSection string) string {
 		return onSection
 	}
 	// Idempotency: skip if already injected
-	if strings.Contains(onSection, "aw_context:") {
+	if strings.Contains(onSection, AwContextInputName+":") {
 		awContextLog.Print("aw_context already injected, skipping")
 		return onSection
 	}
@@ -107,7 +111,7 @@ func buildAwContextInputLines(wdIndent int) []string {
 	awIndent := strings.Repeat(" ", wdIndent+4)   // under inputs:
 	propIndent := strings.Repeat(" ", wdIndent+6) // properties of aw_context
 	return []string{
-		awIndent + "aw_context:",
+		awIndent + AwContextInputName + ":",
 		propIndent + "default: \"\"",
 		propIndent + "description: " + awContextInputDescription,
 		propIndent + "required: false",