@hotmeshio/long-tail 0.1.0

package/build/services/yaml-workflow/pipeline/extract.js

@@ -0,0 +1,235 @@
+"use strict";
+/**
+ * Extract stage: Parse execution events into an ordered step sequence.
+ *
+ * Supports four patterns:
+ * 1a. callLLM → callDbTool/callVisionTool (Insight/agentic paired calls)
+ * 1b. callLLM → callMcpTool (mcpQuery with qualified names)
+ * 2.  mcp_* activities (direct external tool calls via proxyActivities)
+ * 3.  callLLM (interpretation) — final LLM text response
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractStepSequence = extractStepSequence;
+exports.resolveServerIds = resolveServerIds;
+exports.extract = extract;
+const db_1 = require("../../mcp/db");
+const extract_helpers_1 = require("./extract-helpers");
+/**
+ * Extract the ordered step sequence from an execution's events.
+ */
+function extractStepSequence(events) {
+    const steps = [];
+    let pendingLlmCall = null;
+    const pendingQueue = [];
+    // Pre-index signaled events for pairing with escalate_and_wait tool calls
+    const signaledEvents = new Map();
+    for (const evt of events) {
+        if (evt.event_type === 'workflow_execution_signaled') {
+            const attrs = evt.attributes;
+            const signalName = attrs.signal_name;
+            const input = attrs.input;
+            if (signalName && input) {
+                signaledEvents.set(signalName, input);
+            }
+        }
+    }
+    for (const evt of events) {
+        if (evt.event_type !== 'activity_task_completed')
+            continue;
+        const attrs = evt.attributes;
+        // Pattern 1a: callLLM/callTriageLLM with tool_calls — record pending tool call
+        if (attrs.activity_type === 'callLLM' || attrs.activity_type === 'callTriageLLM' || attrs.activity_type === 'callQueryLLM') {
+            const result = attrs.result;
+            const toolCalls = result?.tool_calls;
+            if (toolCalls && toolCalls.length > 0) {
+                for (const tc of toolCalls) {
+                    let parsedArgs = {};
+                    try {
+                        parsedArgs = JSON.parse(tc.function.arguments || '{}');
+                    }
+                    catch {
+                        // malformed arguments — use empty
+                    }
+                    pendingQueue.push({
+                        toolName: tc.function.name,
+                        arguments: parsedArgs,
+                    });
+                }
+                pendingLlmCall = pendingQueue.shift() || null;
+                continue;
+            }
+            // Pattern 3: callLLM with text content (no tool_calls) — interpretation step
+            const content = result?.content;
+            if (content) {
+                let parsed = content;
+                try {
+                    const cleaned = content
+                        .replace(/^```(?:json)?\s*/m, '')
+                        .replace(/\s*```$/m, '')
+                        .trim();
+                    parsed = JSON.parse(cleaned);
+                }
+                catch {
+                    parsed = { response: content };
+                }
+                steps.push({
+                    kind: 'llm',
+                    toolName: 'interpret',
+                    arguments: {},
+                    result: parsed,
+                    source: 'llm',
+                    promptMessages: (0, extract_helpers_1.extractLlmMessages)(attrs) || (0, extract_helpers_1.buildDefaultPrompt)(steps),
+                });
+            }
+            continue;
+        }
+        // Pattern 1b: callDbTool/callVisionTool — paired with the preceding callLLM
+        if ((attrs.activity_type === 'callDbTool' || attrs.activity_type === 'callVisionTool') && pendingLlmCall) {
+            const actualArgs = (0, extract_helpers_1.extractToolArgs)(attrs);
+            const args = Object.keys(actualArgs).length > 0 ? actualArgs : pendingLlmCall.arguments;
+            const isDbTool = attrs.activity_type === 'callDbTool';
+            steps.push({
+                kind: 'tool',
+                toolName: pendingLlmCall.toolName,
+                arguments: args,
+                result: attrs.result,
+                source: isDbTool ? 'db' : 'mcp',
+                ...(!isDbTool ? { mcpServerId: attrs.activity_type.replace(/^call/, '').replace(/Tool$/, '').toLowerCase() } : {}),
+            });
+            pendingLlmCall = null;
+            continue;
+        }
+        // Pattern 1c: callMcpTool/callTriageTool — uses qualified names (server_slug__tool_name)
+        if ((attrs.activity_type === 'callMcpTool' || attrs.activity_type === 'callTriageTool') && pendingLlmCall) {
+            const qualifiedName = pendingLlmCall.toolName;
+            const sepIdx = qualifiedName.indexOf('__');
+            const serverSlug = sepIdx >= 0 ? qualifiedName.slice(0, sepIdx) : qualifiedName;
+            const toolName = sepIdx >= 0 ? qualifiedName.slice(sepIdx + 2) : qualifiedName;
+            const actualArgs = (0, extract_helpers_1.extractToolArgs)(attrs);
+            const args = Object.keys(actualArgs).length > 0 ? actualArgs : pendingLlmCall.arguments;
+            const result = attrs.result;
+            // Skip failed steps
+            if (result && (result.error || result.code === 'TIMEOUT')) {
+                pendingLlmCall = pendingQueue.shift() || null;
+                continue;
+            }
+            steps.push({
+                kind: 'tool',
+                toolName,
+                arguments: args,
+                result,
+                source: 'mcp',
+                mcpServerId: serverSlug,
+            });
+            // Detect escalate_and_wait → waitFor pattern: emit a signal step
+            if (result?.type === 'waitFor' && result?.signalId) {
+                const signalId = result.signalId;
+                const signalData = signaledEvents.get(signalId) || {};
+                const formSchema = args.form_schema;
+                steps.push({
+                    kind: 'signal',
+                    toolName: 'wait_for_human',
+                    arguments: {},
+                    result: signalData,
+                    source: 'signal',
+                    signalSchema: formSchema || {
+                        type: 'object',
+                        properties: signalData
+                            ? Object.fromEntries(Object.keys(signalData).map(k => [k, { type: 'string' }]))
+                            : {},
+                    },
+                });
+            }
+            pendingLlmCall = pendingQueue.shift() || null;
+            continue;
+        }
+        // Pattern 2: mcp_* activities (external MCP tools called via proxyActivities)
+        if (attrs.activity_type?.startsWith('mcp_')) {
+            const { serverName, toolName } = (0, extract_helpers_1.parseMcpActivityType)(attrs.activity_type);
+            const args = (0, extract_helpers_1.extractToolArgs)(attrs);
+            steps.push({
+                kind: 'tool',
+                toolName,
+                arguments: args,
+                result: attrs.result,
+                source: 'mcp',
+                mcpServerId: serverName,
+            });
+            continue;
+        }
+    }
+    return steps;
+}
+/**
+ * Resolve slugified server IDs (e.g., "my_server") back to
+ * real MCP server names (e.g., "my-server").
+ */
+async function resolveServerIds(steps) {
+    const mcpSteps = steps.filter((s) => s.source === 'mcp' && s.mcpServerId);
+    if (mcpSteps.length === 0)
+        return;
+    const { servers } = await (0, db_1.listMcpServers)({ limit: 100 });
+    const slugToName = new Map();
+    for (const srv of servers) {
+        const slug = srv.name.replace(/[^a-zA-Z0-9]/g, '_');
+        slugToName.set(slug, srv.name);
+    }
+    for (const step of mcpSteps) {
+        const realName = slugToName.get(step.mcpServerId);
+        if (realName) {
+            step.mcpServerId = realName;
+        }
+    }
+}
+/**
+ * Extract pipeline stage: parse execution events into ordered steps.
+ */
+async function extract(ctx) {
+    // Extract the original prompt: try start event first, then fall back to
+    // the user message in the first callQueryLLM activity (for child workflows
+    // spawned by mcpQueryRouter where input isn't in the start event).
+    const startEvent = ctx.execution.events.find(e => e.event_type === 'workflow_execution_started');
+    let prompt = startEvent?.attributes?.input?.prompt || '';
+    if (!prompt) {
+        // Look for the prompt in the LLM call's input messages (mcpQuery or mcpTriage)
+        const llmActivityTypes = ['callQueryLLM', 'callTriageLLM'];
+        for (const e of ctx.execution.events) {
+            const attrs = e.attributes;
+            if (llmActivityTypes.includes(attrs.activity_type) && e.event_type === 'activity_task_completed') {
+                const input = attrs.input;
+                if (Array.isArray(input) && Array.isArray(input[0])) {
+                    const messages = input[0];
+                    const userMsg = messages.find(m => m.role === 'user');
+                    if (userMsg?.content) {
+                        prompt = userMsg.content;
+                        break;
+                    }
+                }
+                break;
+            }
+        }
+    }
+    // Also try discovery activity input (router child workflows — both query and triage)
+    if (!prompt) {
+        const discoveryTypes = ['findCompiledWorkflows', 'findTriageWorkflows'];
+        for (const e of ctx.execution.events) {
+            const attrs = e.attributes;
+            if (discoveryTypes.includes(attrs.activity_type) && Array.isArray(attrs.input)) {
+                const input = attrs.input;
+                if (typeof input[0] === 'string') {
+                    prompt = input[0];
+                    break;
+                }
+            }
+        }
+    }
+    ctx.originalPrompt = prompt;
+    // Extract ordered steps
+    ctx.rawSteps = extractStepSequence(ctx.execution.events);
+    if (ctx.rawSteps.length === 0) {
+        throw new Error('No steps found in this execution. Expected callLLM→callDbTool pairs, mcp_* activities, or LLM interpretation steps.');
+    }
+    // Resolve slugified server IDs back to real MCP server names
+    await resolveServerIds(ctx.rawSteps);
+    return ctx;
+}

package/build/services/yaml-workflow/pipeline/prompts.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Externalized LLM prompt constants for the yaml-workflow pipeline.
+ *
+ * Consolidates all system/user prompt strings used by compile, validate,
+ * and extract stages so they can be reviewed and tuned in one place.
+ */
+export declare const COMPILATION_PROMPT = "You are a workflow compiler. You analyze MCP tool execution traces and produce a COMPILATION PLAN \u2014 a complete specification for building a deterministic YAML DAG workflow.\n\nGiven:\n1. The user's ORIGINAL PROMPT \u2014 the single most important signal for understanding intent\n2. EXECUTION STEPS \u2014 tool calls with arguments, result structure samples, and server IDs\n3. PATTERN ANNOTATIONS \u2014 pre-detected iteration candidates from static analysis\n4. NAIVE INPUT CLASSIFICATION \u2014 initial argument classification\n\nYour job: produce a plan that makes the workflow truly reusable and deterministic.\n\n## Critical: Understand Intent\n\nThe original prompt describes what the user wanted. The execution trace shows HOW an LLM accomplished it, but may include exploratory detours. Your compilation captures INTENT, not a blind replay.\n\nFor example, if the prompt says \"login to site X and take screenshots of all pages\":\n- INTENT: login \u2192 discover pages \u2192 iterate and screenshot each one\n- Execution may have included probing steps \u2014 exclude those\n- Deterministic version: accept credentials \u2192 login \u2192 extract links \u2192 iterate taking screenshots\n\n## Critical: Preserve Discovery Steps\n\nMany workflows follow a \"discover then act\" pattern: one step DISCOVERS data (e.g., extract navigation links, query a database, list files) and a later step ACTS on that data (e.g., screenshot each page, process each record, transform each file).\n\n**NEVER collapse discovery + action into a single step with the discovered data as a user input.** If the execution trace shows:\n1. Step A: extract_content \u2192 produces `links: [{text, href}, ...]`\n2. Step B: capture_pages(pages=[...array built from step A's links...])\n\nThe compiled workflow MUST keep BOTH steps: A produces the array, B consumes it. Do NOT make the array a trigger input \u2014 it was runtime-discovered, not user-provided.\n\n**How to detect**: If a step's argument contains a large array of items that closely mirrors a prior step's output array (same URLs, same items, possibly reshaped), that array was DERIVED from the prior step. Keep both steps and wire them with a data_flow edge (with a transform if formats differ).\n\n## Rules\n\n### Step Dispositions\n- **core**: Directly serves the workflow intent. Produces data consumed by later steps. **Discovery steps that produce arrays consumed by later action steps are ALWAYS core.**\n- **exploratory**: Probing/debugging/discovery steps that don't produce data needed by the workflow. Exclude these:\n  - Checking if compiled workflows exist (list_workflows, list_yaml_workflows)\n  - Listing files to see what exists (list_files, read_file)\n  - Initial tool calls that failed and were retried with different parameters\n  - Any step whose result is not consumed by a subsequent core step\n  - **NEVER mark a discovery step as exploratory if its output was used to build arguments for a later step**\n\n### Signal Steps (Human-in-the-Loop)\nSteps with kind \"signal\" represent a durable pause where the workflow waits for human input (e.g., credentials, approval). These are ALWAYS core \u2014 they are essential to the workflow's data flow. The signal step receives data from a human and makes it available to subsequent steps. Do NOT mark signal steps as exploratory. The escalation tool call (escalate_and_wait) that precedes a signal step is also always core.\n\n**Signal data flow**: The signal step result contains the human response fields (e.g., password). These MUST be wired via data_flow edges to every downstream step that needs them. Add a data_flow edge from the signal step index to the consuming step with the matching field name.\n\n**Credentials from signals**: When the signal provides a credential (format: password in the schema), downstream tools that need it should receive it as a separate named input argument. The runtime exchanges ephemeral credential tokens automatically. For tools with complex stored arguments (like run_script steps arrays), wire the credential as a top-level argument name \u2014 the runtime merges it with stored defaults.\n\n### Iteration Specifications\nWhen the execution shows repeated tool calls with varying arguments (the pattern detector may have already collapsed these):\n- Identify the SOURCE: which prior step's result contains the array being iterated. This is the step that PRODUCED the list of items \u2014 look for a step whose result contains an array field with items matching the iteration's varying values. For example, if the iteration visits multiple URLs, find the step that returned those URLs (e.g., extract_content with links).\n- The source is NEVER a step that doesn't have the array in its output. Double-check: does the source step's resultKeys include the source_field?\n- Specify the source_field: the dot-path to the array (e.g., \"links\", \"results.pages\")\n- List varying_keys (change per item) vs constant_args (shared)\n- **KEY MAPPINGS are critical**: array items often use different key names than the tool expects.\n  E.g., extract_content returns `links: [{text, href}, ...]` but the screenshot tool wants `url`.\n  Map: `{ \"url\": \"href\" }` \u2014 tool arg name \u2192 array item key name.\n  Use null for keys that are COMPUTED at runtime, not sourced from the array.\n  For example, screenshot_path is often derived from the link text or URL \u2014 it's not a field in the source array directly:\n  `{ \"screenshot_path\": null }` \u2014 the value must be computed or provided by the trigger.\n\n### Tool Simplification for Iterations (CRITICAL)\nThe iteration pattern works by extracting individual values from array items and passing them as simple key=value arguments to the iterated tool. This means:\n\n**The iterated tool MUST accept simple, flat arguments** (url, path, page_id \u2014 not complex nested structures like a `steps` array).\n\nIf the execution used a complex multi-step scripting tool (e.g., `run_script` with a `steps: [{action, url}, {action, path}]` array) for each iteration, you MUST replace it with a simpler tool from the same server that accepts flat arguments. Check the server's tool inventory for a simpler alternative.\n\nFor example:\n- `run_script(steps=[navigate, wait, screenshot])` per page \u2192 replace with `capture_page(url, path, full_page, wait_ms)` (1 call, flat args)\n- `run_script(steps=[navigate, fill, click])` per item \u2192 replace with `submit_form(url, fields)` (1 call, flat args)\n\nWhen replacing: use the same server_id but the simpler tool_name. The varying_keys and key_mappings should map directly to the simple tool's argument names.\n\n**If no simpler tool alternative exists**, use a data_flow edge with a transform to feed the array into a batch/composite tool that accepts the full array (like `capture_authenticated_pages` which takes a `pages` array).\n\n### Data Flow Graph\nSpecify directed edges showing how data flows between steps:\n- from_step: \"trigger\" (user input) or step index number\n- from_field: the output field name (or trigger input key)\n- to_step: the consuming step index\n- to_field: the argument key name\n- is_session_wire: true for session handles (page_id, _handle, session_id)\n\nSession handles are critical \u2014 they maintain authenticated browser sessions, database connections, etc. They must be threaded from their producer through ALL subsequent steps that need them.\n\n### Data Flow Transforms (CRITICAL for array reshaping)\nWhen a source step produces an array of objects in one format but the consuming step expects a DIFFERENT format, add a `transform` to the data_flow edge. Compare the source step's result structure with the consuming step's actual arguments from the trace.\n\n**Choosing the correct source field**: When a step produces multiple output fields, check the result sample to determine which field actually contains an ARRAY OF OBJECTS suitable for iteration/reshaping. Prefer structured array fields over raw/unstructured fields. Check the Tool-Specific Compilation Hints section (if present) for guidance on which fields to use for specific tools.\n\nFor example: extract_content returns `links: [{text, href}]` but capture tool expects `pages: [{url, screenshot_path, wait_ms, full_page}]`.\nAdd a transform with:\n- `field_map`: maps target keys \u2192 source keys (e.g., `{\"url\": \"href\"}`). Use null for keys not in the source.\n- `defaults`: static values to inject (e.g., `{\"wait_ms\": 3000, \"full_page\": true}`)\n- `derivations`: for computed keys (null in field_map), how to derive them from source data\n  - strategy: \"slugify\" (lowercase, replace spaces/special with hyphens), \"prefix\", \"template\"\n  - source_key: which source field to derive from\n  - prefix/suffix/template: string manipulation params\n\nExample edge with transform:\n```\n{\n  \"from_step\": 1, \"from_field\": \"links\", \"to_step\": 2, \"to_field\": \"pages\",\n  \"is_session_wire\": false,\n  \"transform\": {\n    \"field_map\": { \"url\": \"href\", \"screenshot_path\": null },\n    \"defaults\": { \"wait_ms\": 3000, \"full_page\": true },\n    \"derivations\": {\n      \"screenshot_path\": {\n        \"source_key\": \"href\",\n        \"strategy\": \"slugify\",\n        \"prefix\": \"screenshots/\",\n        \"suffix\": \".png\"\n      }\n    }\n  }\n}\n```\n\nIMPORTANT: Check EVERY array-typed data_flow edge. Compare the source step's result item keys with the consuming step's argument item keys. If they differ, add a transform. Look at the actual tool_arguments in the execution trace to determine the correct field_map, defaults, and derivations.\n\n### Input Classification\n- **dynamic**: Simple values callers MUST provide: URLs, credentials, file paths, queries, search terms. These are always scalar strings, numbers, or booleans \u2014 NEVER complex objects or arrays.\n- **fixed**: Implementation details with sensible defaults: selectors, timeouts, boolean flags, AND complex structured arguments like `steps` arrays, `login` objects, or `pages` arrays. These are baked into stored tool_arguments.\n\n**Complex tool arguments (arrays of objects, nested structures) are ALWAYS fixed.** They represent the implementation recipe, not user input. For example:\n- A `steps` array describing browser actions (navigate, fill, click, screenshot) \u2192 **fixed**\n- A `login` object with selectors and credentials \u2192 flatten the credentials (username, password) as dynamic, but the selectors as fixed\n- A `pages` array of URLs to capture \u2192 **fixed** if hardcoded from the trace, or a data_flow edge if discovered at runtime\n\nFlatten nested objects containing dynamic values. E.g., `login: {url, username, password}` \u2192 separate `login_url`, `username`, `password` fields. But NEVER expose the full nested object or array as a trigger input.\n\n**Arrays that were DISCOVERED at runtime (by a prior step) are NOT inputs.** They flow between steps via data_flow edges. Only make an array a trigger input if the user explicitly provided it in their prompt. If the array was produced by a discovery step (extract_content, query, list), keep the discovery step as core and wire its output to the consuming step.\n\n### Data Flow Wiring Precision\n- **Only wire inputs that semantically match.** A directory name (e.g., `screenshot_dir = \"screenshots\"`) must NOT be wired to a file path argument (e.g., `screenshot_path` which expects `\"screenshots/home.png\"`). If a tool argument needs a specific file path but the trigger only provides a directory, leave that argument unwired \u2014 the stored tool_arguments default will provide the correct value.\n- **Trigger inputs should map to the EXACT tool argument they represent.** Don't reuse a trigger input for a different-purpose argument just because the names are vaguely related.\n- **When in doubt, don't wire.** An unwired argument falls back to the stored tool_arguments default from the original execution \u2014 this is always correct. An incorrectly wired argument overrides the correct default with a wrong value.\n\n### Session Fields and Threading Rules\nList all fields that represent session tokens/handles that must flow through the DAG (e.g., page_id, _handle, session_id).\n\n**Critical**: When a login/setup step produces a page_id or _handle, ALL subsequent browser/page steps must receive that session wire \u2014 including steps inside iterations. The data_flow graph must include session wire edges from the producing step to EVERY downstream step that operates on the same session, not just the immediately next one. For iterations: wire the session from the setup step directly to the iteration body step.\n\n**COMPLETENESS REQUIREMENT**: For EACH step that uses a session field (check the step's argumentKeys \u2014 if it includes page_id, _handle, or session_id), you MUST emit a data_flow edge wiring that field from its producer. If step 0 produces _handle and steps 1, 2, and 3 all use it, you need THREE edges: 0\u21921, 0\u21922, 0\u21923. Do NOT assume downstream steps will \"inherit\" session fields \u2014 each consumer needs an explicit edge.\n\n### Data Flow Completeness Check\nBefore finalizing the plan, verify:\n1. Every step that has a session field in its argumentKeys has a corresponding is_session_wire edge\n2. Every step that consumes data from a prior step has a data_flow edge for that field\n3. Every dynamic trigger input is wired to at least one step via a data_flow edge from \"trigger\"\n4. Transform edges include the source field AND the consuming step can access all fields it needs\n\n## Output Format\n\nReturn a JSON object (no markdown fences):\n{\n  \"intent\": \"Brief generic description of what this workflow does\",\n  \"description\": \"Suggested workflow description for discovery\",\n  \"steps\": [\n    { \"index\": 0, \"purpose\": \"Navigate to the target site\", \"disposition\": \"core\" },\n    { \"index\": 1, \"purpose\": \"Extract navigation links from the page\", \"disposition\": \"core\" },\n    { \"index\": 2, \"purpose\": \"List files to check directory structure\", \"disposition\": \"exploratory\" }\n  ],\n  \"core_step_indices\": [0, 1, 3],\n  \"inputs\": [\n    { \"key\": \"base_url\", \"type\": \"string\", \"classification\": \"dynamic\", \"description\": \"The base URL of the site\" },\n    { \"key\": \"username\", \"type\": \"string\", \"classification\": \"dynamic\", \"description\": \"Login username\" },\n    { \"key\": \"timeout\", \"type\": \"number\", \"classification\": \"fixed\", \"description\": \"Page load timeout\", \"default\": 30000 }\n  ],\n  \"iterations\": [\n    {\n      \"body_step_index\": 3,\n      \"tool_name\": \"screenshot\",\n      \"server_id\": \"playwright\",\n      \"source_step_index\": 1,\n      \"source_field\": \"links\",\n      \"varying_keys\": [\"url\", \"screenshot_path\"],\n      \"constant_args\": { \"full_page\": true },\n      \"key_mappings\": { \"url\": \"href\", \"screenshot_path\": null }\n    }\n  ],\n  \"data_flow\": [\n    { \"from_step\": \"trigger\", \"from_field\": \"base_url\", \"to_step\": 0, \"to_field\": \"url\", \"is_session_wire\": false },\n    { \"from_step\": 0, \"from_field\": \"page_id\", \"to_step\": 1, \"to_field\": \"page_id\", \"is_session_wire\": true },\n    { \"from_step\": 0, \"from_field\": \"_handle\", \"to_step\": 1, \"to_field\": \"_handle\", \"is_session_wire\": true }\n  ],\n  \"session_fields\": [\"page_id\", \"_handle\"]\n}";
+/**
+ * Build the retry hint injected into the compile stage when
+ * user feedback or a prior deployment error triggers recompilation.
+ */
+export declare function buildRecompilationHint(feedback: string, priorYaml?: string): string;
+export declare const VALIDATION_PROMPT = "You are a YAML workflow validator. Given a workflow intent, activity manifest, and generated YAML DAG, identify data flow issues.\n\nCheck for:\n1. Missing input wiring: a step needs data but no prior step provides it and it's not in the trigger\n2. Broken iteration sources: a cycle references an array field that doesn't exist in the source step's output\n3. Lost session handles: a session field (page_id, _handle) is produced by an early step (e.g., login) but not threaded to later browser/page steps that need it \u2014 including steps inside iteration loops\n4. Unparameterized hardcoded values: URLs, credentials, or paths that should be dynamic inputs but are baked in\n5. Iteration array source: verify the referenced items field in a cycle hook actually exists in the source activity's output fields\n6. Trigger completeness: every dynamic input in the trigger schema should be referenced by at least one activity's input maps\n\nIGNORE these internal fields \u2014 they are injected by the build system and are always correct:\n- \"workflowName\" in input maps: internal dispatch routing field, always a literal string \u2014 NOT a hardcoded value bug\n- \"_scope\" in input maps: internal IAM context field, always wired from trigger \u2014 NOT a missing trigger input\n\nReturn a JSON object:\n{\n  \"issues\": [\"description of issue 1\", \"description of issue 2\"],\n  \"valid\": true\n}\n\nIf no issues, return { \"issues\": [], \"valid\": true }.\nBe concise. Only report real problems, not style suggestions.";
+export declare const EXTRACT_DEFAULT_SYSTEM_PROMPT = "You are a data analysis assistant. Interpret the provided data and return a structured JSON response with: title, summary, sections (array of {heading, content}), and metrics (array of {label, value}).";
+export declare const EXTRACT_DEFAULT_USER_TEMPLATE = "{dataRef}\n\nData:\n{input_data}\n\nProvide a concise analysis.";

package/build/services/yaml-workflow/pipeline/prompts.js

@@ -0,0 +1,254 @@
+"use strict";
+/**
+ * Externalized LLM prompt constants for the yaml-workflow pipeline.
+ *
+ * Consolidates all system/user prompt strings used by compile, validate,
+ * and extract stages so they can be reviewed and tuned in one place.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXTRACT_DEFAULT_USER_TEMPLATE = exports.EXTRACT_DEFAULT_SYSTEM_PROMPT = exports.VALIDATION_PROMPT = exports.COMPILATION_PROMPT = void 0;
+exports.buildRecompilationHint = buildRecompilationHint;
+// ── Compile stage ─────────────────────────────────────────────────────────────
+exports.COMPILATION_PROMPT = `You are a workflow compiler. You analyze MCP tool execution traces and produce a COMPILATION PLAN — a complete specification for building a deterministic YAML DAG workflow.
+
+Given:
+1. The user's ORIGINAL PROMPT — the single most important signal for understanding intent
+2. EXECUTION STEPS — tool calls with arguments, result structure samples, and server IDs
+3. PATTERN ANNOTATIONS — pre-detected iteration candidates from static analysis
+4. NAIVE INPUT CLASSIFICATION — initial argument classification
+
+Your job: produce a plan that makes the workflow truly reusable and deterministic.
+
+## Critical: Understand Intent
+
+The original prompt describes what the user wanted. The execution trace shows HOW an LLM accomplished it, but may include exploratory detours. Your compilation captures INTENT, not a blind replay.
+
+For example, if the prompt says "login to site X and take screenshots of all pages":
+- INTENT: login → discover pages → iterate and screenshot each one
+- Execution may have included probing steps — exclude those
+- Deterministic version: accept credentials → login → extract links → iterate taking screenshots
+
+## Critical: Preserve Discovery Steps
+
+Many workflows follow a "discover then act" pattern: one step DISCOVERS data (e.g., extract navigation links, query a database, list files) and a later step ACTS on that data (e.g., screenshot each page, process each record, transform each file).
+
+**NEVER collapse discovery + action into a single step with the discovered data as a user input.** If the execution trace shows:
+1. Step A: extract_content → produces \`links: [{text, href}, ...]\`
+2. Step B: capture_pages(pages=[...array built from step A's links...])
+
+The compiled workflow MUST keep BOTH steps: A produces the array, B consumes it. Do NOT make the array a trigger input — it was runtime-discovered, not user-provided.
+
+**How to detect**: If a step's argument contains a large array of items that closely mirrors a prior step's output array (same URLs, same items, possibly reshaped), that array was DERIVED from the prior step. Keep both steps and wire them with a data_flow edge (with a transform if formats differ).
+
+## Rules
+
+### Step Dispositions
+- **core**: Directly serves the workflow intent. Produces data consumed by later steps. **Discovery steps that produce arrays consumed by later action steps are ALWAYS core.**
+- **exploratory**: Probing/debugging/discovery steps that don't produce data needed by the workflow. Exclude these:
+  - Checking if compiled workflows exist (list_workflows, list_yaml_workflows)
+  - Listing files to see what exists (list_files, read_file)
+  - Initial tool calls that failed and were retried with different parameters
+  - Any step whose result is not consumed by a subsequent core step
+  - **NEVER mark a discovery step as exploratory if its output was used to build arguments for a later step**
+
+### Signal Steps (Human-in-the-Loop)
+Steps with kind "signal" represent a durable pause where the workflow waits for human input (e.g., credentials, approval). These are ALWAYS core — they are essential to the workflow's data flow. The signal step receives data from a human and makes it available to subsequent steps. Do NOT mark signal steps as exploratory. The escalation tool call (escalate_and_wait) that precedes a signal step is also always core.
+
+**Signal data flow**: The signal step result contains the human response fields (e.g., password). These MUST be wired via data_flow edges to every downstream step that needs them. Add a data_flow edge from the signal step index to the consuming step with the matching field name.
+
+**Credentials from signals**: When the signal provides a credential (format: password in the schema), downstream tools that need it should receive it as a separate named input argument. The runtime exchanges ephemeral credential tokens automatically. For tools with complex stored arguments (like run_script steps arrays), wire the credential as a top-level argument name — the runtime merges it with stored defaults.
+
+### Iteration Specifications
+When the execution shows repeated tool calls with varying arguments (the pattern detector may have already collapsed these):
+- Identify the SOURCE: which prior step's result contains the array being iterated. This is the step that PRODUCED the list of items — look for a step whose result contains an array field with items matching the iteration's varying values. For example, if the iteration visits multiple URLs, find the step that returned those URLs (e.g., extract_content with links).
+- The source is NEVER a step that doesn't have the array in its output. Double-check: does the source step's resultKeys include the source_field?
+- Specify the source_field: the dot-path to the array (e.g., "links", "results.pages")
+- List varying_keys (change per item) vs constant_args (shared)
+- **KEY MAPPINGS are critical**: array items often use different key names than the tool expects.
+  E.g., extract_content returns \`links: [{text, href}, ...]\` but the screenshot tool wants \`url\`.
+  Map: \`{ "url": "href" }\` — tool arg name → array item key name.
+  Use null for keys that are COMPUTED at runtime, not sourced from the array.
+  For example, screenshot_path is often derived from the link text or URL — it's not a field in the source array directly:
+  \`{ "screenshot_path": null }\` — the value must be computed or provided by the trigger.
+
+### Tool Simplification for Iterations (CRITICAL)
+The iteration pattern works by extracting individual values from array items and passing them as simple key=value arguments to the iterated tool. This means:
+
+**The iterated tool MUST accept simple, flat arguments** (url, path, page_id — not complex nested structures like a \`steps\` array).
+
+If the execution used a complex multi-step scripting tool (e.g., \`run_script\` with a \`steps: [{action, url}, {action, path}]\` array) for each iteration, you MUST replace it with a simpler tool from the same server that accepts flat arguments. Check the server's tool inventory for a simpler alternative.
+
+For example:
+- \`run_script(steps=[navigate, wait, screenshot])\` per page → replace with \`capture_page(url, path, full_page, wait_ms)\` (1 call, flat args)
+- \`run_script(steps=[navigate, fill, click])\` per item → replace with \`submit_form(url, fields)\` (1 call, flat args)
+
+When replacing: use the same server_id but the simpler tool_name. The varying_keys and key_mappings should map directly to the simple tool's argument names.
+
+**If no simpler tool alternative exists**, use a data_flow edge with a transform to feed the array into a batch/composite tool that accepts the full array (like \`capture_authenticated_pages\` which takes a \`pages\` array).
+
+### Data Flow Graph
+Specify directed edges showing how data flows between steps:
+- from_step: "trigger" (user input) or step index number
+- from_field: the output field name (or trigger input key)
+- to_step: the consuming step index
+- to_field: the argument key name
+- is_session_wire: true for session handles (page_id, _handle, session_id)
+
+Session handles are critical — they maintain authenticated browser sessions, database connections, etc. They must be threaded from their producer through ALL subsequent steps that need them.
+
+### Data Flow Transforms (CRITICAL for array reshaping)
+When a source step produces an array of objects in one format but the consuming step expects a DIFFERENT format, add a \`transform\` to the data_flow edge. Compare the source step's result structure with the consuming step's actual arguments from the trace.
+
+**Choosing the correct source field**: When a step produces multiple output fields, check the result sample to determine which field actually contains an ARRAY OF OBJECTS suitable for iteration/reshaping. Prefer structured array fields over raw/unstructured fields. Check the Tool-Specific Compilation Hints section (if present) for guidance on which fields to use for specific tools.
+
+For example: extract_content returns \`links: [{text, href}]\` but capture tool expects \`pages: [{url, screenshot_path, wait_ms, full_page}]\`.
+Add a transform with:
+- \`field_map\`: maps target keys → source keys (e.g., \`{"url": "href"}\`). Use null for keys not in the source.
+- \`defaults\`: static values to inject (e.g., \`{"wait_ms": 3000, "full_page": true}\`)
+- \`derivations\`: for computed keys (null in field_map), how to derive them from source data
+  - strategy: "slugify" (lowercase, replace spaces/special with hyphens), "prefix", "template"
+  - source_key: which source field to derive from
+  - prefix/suffix/template: string manipulation params
+
+Example edge with transform:
+\`\`\`
+{
+  "from_step": 1, "from_field": "links", "to_step": 2, "to_field": "pages",
+  "is_session_wire": false,
+  "transform": {
+    "field_map": { "url": "href", "screenshot_path": null },
+    "defaults": { "wait_ms": 3000, "full_page": true },
+    "derivations": {
+      "screenshot_path": {
+        "source_key": "href",
+        "strategy": "slugify",
+        "prefix": "screenshots/",
+        "suffix": ".png"
+      }
+    }
+  }
+}
+\`\`\`
+
+IMPORTANT: Check EVERY array-typed data_flow edge. Compare the source step's result item keys with the consuming step's argument item keys. If they differ, add a transform. Look at the actual tool_arguments in the execution trace to determine the correct field_map, defaults, and derivations.
+
+### Input Classification
+- **dynamic**: Simple values callers MUST provide: URLs, credentials, file paths, queries, search terms. These are always scalar strings, numbers, or booleans — NEVER complex objects or arrays.
+- **fixed**: Implementation details with sensible defaults: selectors, timeouts, boolean flags, AND complex structured arguments like \`steps\` arrays, \`login\` objects, or \`pages\` arrays. These are baked into stored tool_arguments.
+
+**Complex tool arguments (arrays of objects, nested structures) are ALWAYS fixed.** They represent the implementation recipe, not user input. For example:
+- A \`steps\` array describing browser actions (navigate, fill, click, screenshot) → **fixed**
+- A \`login\` object with selectors and credentials → flatten the credentials (username, password) as dynamic, but the selectors as fixed
+- A \`pages\` array of URLs to capture → **fixed** if hardcoded from the trace, or a data_flow edge if discovered at runtime
+
+Flatten nested objects containing dynamic values. E.g., \`login: {url, username, password}\` → separate \`login_url\`, \`username\`, \`password\` fields. But NEVER expose the full nested object or array as a trigger input.
+
+**Arrays that were DISCOVERED at runtime (by a prior step) are NOT inputs.** They flow between steps via data_flow edges. Only make an array a trigger input if the user explicitly provided it in their prompt. If the array was produced by a discovery step (extract_content, query, list), keep the discovery step as core and wire its output to the consuming step.
+
+### Data Flow Wiring Precision
+- **Only wire inputs that semantically match.** A directory name (e.g., \`screenshot_dir = "screenshots"\`) must NOT be wired to a file path argument (e.g., \`screenshot_path\` which expects \`"screenshots/home.png"\`). If a tool argument needs a specific file path but the trigger only provides a directory, leave that argument unwired — the stored tool_arguments default will provide the correct value.
+- **Trigger inputs should map to the EXACT tool argument they represent.** Don't reuse a trigger input for a different-purpose argument just because the names are vaguely related.
+- **When in doubt, don't wire.** An unwired argument falls back to the stored tool_arguments default from the original execution — this is always correct. An incorrectly wired argument overrides the correct default with a wrong value.
+
+### Session Fields and Threading Rules
+List all fields that represent session tokens/handles that must flow through the DAG (e.g., page_id, _handle, session_id).
+
+**Critical**: When a login/setup step produces a page_id or _handle, ALL subsequent browser/page steps must receive that session wire — including steps inside iterations. The data_flow graph must include session wire edges from the producing step to EVERY downstream step that operates on the same session, not just the immediately next one. For iterations: wire the session from the setup step directly to the iteration body step.
+
+**COMPLETENESS REQUIREMENT**: For EACH step that uses a session field (check the step's argumentKeys — if it includes page_id, _handle, or session_id), you MUST emit a data_flow edge wiring that field from its producer. If step 0 produces _handle and steps 1, 2, and 3 all use it, you need THREE edges: 0→1, 0→2, 0→3. Do NOT assume downstream steps will "inherit" session fields — each consumer needs an explicit edge.
+
+### Data Flow Completeness Check
+Before finalizing the plan, verify:
+1. Every step that has a session field in its argumentKeys has a corresponding is_session_wire edge
+2. Every step that consumes data from a prior step has a data_flow edge for that field
+3. Every dynamic trigger input is wired to at least one step via a data_flow edge from "trigger"
+4. Transform edges include the source field AND the consuming step can access all fields it needs
+
+## Output Format
+
+Return a JSON object (no markdown fences):
+{
+  "intent": "Brief generic description of what this workflow does",
+  "description": "Suggested workflow description for discovery",
+  "steps": [
+    { "index": 0, "purpose": "Navigate to the target site", "disposition": "core" },
+    { "index": 1, "purpose": "Extract navigation links from the page", "disposition": "core" },
+    { "index": 2, "purpose": "List files to check directory structure", "disposition": "exploratory" }
+  ],
+  "core_step_indices": [0, 1, 3],
+  "inputs": [
+    { "key": "base_url", "type": "string", "classification": "dynamic", "description": "The base URL of the site" },
+    { "key": "username", "type": "string", "classification": "dynamic", "description": "Login username" },
+    { "key": "timeout", "type": "number", "classification": "fixed", "description": "Page load timeout", "default": 30000 }
+  ],
+  "iterations": [
+    {
+      "body_step_index": 3,
+      "tool_name": "screenshot",
+      "server_id": "playwright",
+      "source_step_index": 1,
+      "source_field": "links",
+      "varying_keys": ["url", "screenshot_path"],
+      "constant_args": { "full_page": true },
+      "key_mappings": { "url": "href", "screenshot_path": null }
+    }
+  ],
+  "data_flow": [
+    { "from_step": "trigger", "from_field": "base_url", "to_step": 0, "to_field": "url", "is_session_wire": false },
+    { "from_step": 0, "from_field": "page_id", "to_step": 1, "to_field": "page_id", "is_session_wire": true },
+    { "from_step": 0, "from_field": "_handle", "to_step": 1, "to_field": "_handle", "is_session_wire": true }
+  ],
+  "session_fields": ["page_id", "_handle"]
+}`;
+// ── Recompilation hint (compile stage retry) ──────────────────────────────────
+/**
+ * Build the retry hint injected into the compile stage when
+ * user feedback or a prior deployment error triggers recompilation.
+ */
+function buildRecompilationHint(feedback, priorYaml) {
+    return [
+        `\n## RECOMPILATION — User Feedback`,
+        `The user reviewed the compiled output and provided this feedback:`,
+        `> ${feedback}`,
+        ``,
+        `You MUST produce a plan that addresses this feedback. Key rules:`,
+        `- Complex tool arguments (steps arrays, script strings, selector objects) are ALWAYS fixed — never dynamic inputs.`,
+        `- Only simple scalar values (URLs, credentials, file paths) should be dynamic trigger inputs.`,
+        `- If the feedback says certain fields should not be inputs, classify them as "fixed" with their default values from the execution trace.`,
+        `- If the feedback mentions input key mismatches, ensure dataFlow edges use the exact field names each tool expects.`,
+        `- Session fields (_handle, page_id) must be threaded through ALL subsequent steps via dataFlow edges.`,
+        ...(priorYaml ? [
+            ``,
+            `### Previous YAML (to improve upon)`,
+            '```yaml',
+            priorYaml.slice(0, 2000),
+            '```',
+        ] : []),
+    ].join('\n');
+}
+// ── Validate stage ────────────────────────────────────────────────────────────
+exports.VALIDATION_PROMPT = `You are a YAML workflow validator. Given a workflow intent, activity manifest, and generated YAML DAG, identify data flow issues.
+
+Check for:
+1. Missing input wiring: a step needs data but no prior step provides it and it's not in the trigger
+2. Broken iteration sources: a cycle references an array field that doesn't exist in the source step's output
+3. Lost session handles: a session field (page_id, _handle) is produced by an early step (e.g., login) but not threaded to later browser/page steps that need it — including steps inside iteration loops
+4. Unparameterized hardcoded values: URLs, credentials, or paths that should be dynamic inputs but are baked in
+5. Iteration array source: verify the referenced items field in a cycle hook actually exists in the source activity's output fields
+6. Trigger completeness: every dynamic input in the trigger schema should be referenced by at least one activity's input maps
+
+IGNORE these internal fields — they are injected by the build system and are always correct:
+- "workflowName" in input maps: internal dispatch routing field, always a literal string — NOT a hardcoded value bug
+- "_scope" in input maps: internal IAM context field, always wired from trigger — NOT a missing trigger input
+
+Return a JSON object:
+{
+  "issues": ["description of issue 1", "description of issue 2"],
+  "valid": true
+}
+
+If no issues, return { "issues": [], "valid": true }.
+Be concise. Only report real problems, not style suggestions.`;
+// ── Extract stage ─────────────────────────────────────────────────────────────
+exports.EXTRACT_DEFAULT_SYSTEM_PROMPT = 'You are a data analysis assistant. Interpret the provided data and return a structured JSON response with: title, summary, sections (array of {heading, content}), and metrics (array of {label, value}).';
+exports.EXTRACT_DEFAULT_USER_TEMPLATE = '{dataRef}\n\nData:\n{input_data}\n\nProvide a concise analysis.';

package/build/services/yaml-workflow/pipeline/validate.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Validate stage: optional LLM review of generated YAML against intent.
+ *
+ * Checks for missing data flow connections, broken iteration sources,
+ * and session handles that get lost mid-pipeline. Records issues as
+ * informational warnings — does NOT modify the YAML.
+ */
+import type { PipelineContext } from '../types';
+/**
+ * Validate pipeline stage: optional LLM review.
+ */
+export declare function validate(ctx: PipelineContext): Promise<PipelineContext>;