@oxygen-agent/cli 1.696.2 → 1.717.1

package/node_modules/@oxygen/workflows/dist/graph/lint.js

@@ -7,7 +7,7 @@
 // why ./index.ts (the "@oxygen/workflows/graph" entry) does not re-export this
 // module — the editor lints through the API, not in the bundle.
 import { validateFormulaExpression } from "@oxygen/formula";
-import { isWorkflowToolRejected, validateOptionalMaxCredits, validatePureFunctionSource, validateTrigger, } from "../index.js";
+import { isWorkflowToolRejected, lintRecipeManifest, validateOptionalMaxCredits, validatePureFunctionSource, validateTrigger, } from "../index.js";
 import { UNARY_COMPARE_OPS, WORKFLOW_COMPARE_OPS, compileConditionPattern, parseScopePath, SCOPE_PATH_ROOTS, } from "./expression.js";
 import { missingToolParams, unknownToolParams } from "./params.js";
 import { danglingEdges, findIllegalCycles, loopBodyNodeIds, reachableNodeIds } from "./topology.js";
@@ -254,14 +254,7 @@ node, path, add, scope, options) {
             lintApprovalNode(node, path, add, scope);
             return;
         case "code":
-            // v2 `code` nodes run through the same sandbox as v1 transform steps, so
-            // they clear the same purity scan; every issue it raises is re-labelled to
-            // the v2 code so callers match on one code for "this source is not safe".
-            if (typeof node.run_source !== "string") {
-                add(`${path}.run_source`, "unsafe_code_source", "Code node run_source is required.");
-                return;
-            }
-            validatePureFunctionSource(node.run_source, `${path}.run_source`, (issuePath, _code, message) => add(issuePath, "unsafe_code_source", message));
+            lintCodeNode(node, path, add, scope, options);
             return;
         case "workflow":
             if (!isNonEmptyString(node.workflow_id)) {
@@ -280,7 +273,67 @@ node, path, add, scope, options) {
             return;
     }
 }
+function lintCodeNode(node, path, add, scope, options) {
+    const hasSource = typeof node.run_source === "string";
+    const hasRecipe = isRecord(node.recipe);
+    if (hasSource === hasRecipe) {
+        add(path, "ambiguous_code_runtime", "A code node must declare exactly one executable runtime: run_source or recipe.");
+        return;
+    }
+    if (hasSource) {
+        // v2 source nodes run through the same sandbox as v1 transform steps, so
+        // they clear the same purity scan; every issue it raises is re-labelled to
+        // the v2 code so callers match on one code for "this source is not safe".
+        validatePureFunctionSource(node.run_source, `${path}.run_source`, (issuePath, _code, message) => add(issuePath, "unsafe_code_source", message));
+        validateLegacyContext(node, path, add);
+        if (node.configuration !== undefined) {
+            add(`${path}.configuration`, "unexpected_recipe_configuration", "Source code nodes cannot declare recipe configuration.");
+        }
+        return;
+    }
+    // The graph owns configuration as value refs, which are resolved only at run
+    // time. The standalone recipe linter validates concrete JSON values, so lint
+    // the executable envelope without its literal configuration and validate the
+    // graph binding shape/required keys below instead.
+    const { configuration_schema: _configurationSchema, configuration: _configuration, ...recipeEnvelope } = node.recipe;
+    const recipeResult = lintRecipeManifest(recipeEnvelope, options);
+    for (const issue of recipeResult.issues) {
+        const suffix = issue.path === "$" ? "" : issue.path.slice(1);
+        add(`${path}.recipe${suffix}`, issue.code, issue.message);
+    }
+    validateValueRefRecord(node.configuration, `${path}.configuration`, add, scope);
+    if (node.legacy_context !== undefined) {
+        add(`${path}.legacy_context`, "unexpected_legacy_context", "Durable recipe nodes do not use legacy_context.");
+    }
+    const rawSchema = node.recipe.configuration_schema;
+    if (rawSchema !== undefined && !isRecord(rawSchema)) {
+        add(`${path}.recipe.configuration_schema`, "invalid_configuration_schema", "Recipe configuration_schema must be a JSON Schema object.");
+    }
+    const schema = isRecord(rawSchema)
+        ? node.recipe.configuration_schema
+        : null;
+    if (!schema)
+        return;
+    const configuration = isRecord(node.configuration) ? node.configuration : {};
+    const properties = isRecord(schema.properties) ? schema.properties : {};
+    const required = Array.isArray(schema.required)
+        ? schema.required.filter((name) => typeof name === "string")
+        : [];
+    for (const name of required) {
+        if (!Object.hasOwn(configuration, name)) {
+            add(`${path}.configuration`, "incomplete_recipe_configuration", `Durable recipe configuration still needs '${name}'.`);
+        }
+    }
+    if (schema.additionalProperties === false) {
+        for (const name of Object.keys(configuration)) {
+            if (!Object.hasOwn(properties, name)) {
+                add(`${path}.configuration.${name}`, "unknown_recipe_configuration", `Durable recipe configuration has no field called '${name}'.`);
+            }
+        }
+    }
+}
 function lintToolNode(node, path, add, scope, options) {
+    const hasPayloadSource = typeof node.payload_source === "string";
     if (!isNonEmptyString(node.tool)) {
         add(`${path}.tool`, "missing_tool", "Tool node tool id is required.");
     }
@@ -296,7 +349,7 @@ function lintToolNode(node, path, add, scope, options) {
     // refused an unconfigured node while apply accepted the identical manifest, and
     // a CLI-authored one was never checked at all — a guarantee the GUI enforces
     // alone is not a guarantee.
-    if (isNonEmptyString(node.tool) && options.resolveToolParamFields) {
+    if (!hasPayloadSource && isNonEmptyString(node.tool) && options.resolveToolParamFields) {
         const resolved = options.resolveToolParamFields(node.tool);
         // Array.isArray does not narrow a `readonly T[]` union, so normalize once.
         const bag = resolved == null
@@ -341,7 +394,7 @@ function lintToolNode(node, path, add, scope, options) {
         if (resolveEffect) {
             const canonicalEffect = resolveEffect(node.tool);
             if (canonicalEffect !== null && node.effect !== canonicalEffect) {
-                add(`${path}.effect`, "tool_effect_mismatch", `Tool '${node.tool}' has canonical effect '${canonicalEffect}', not '${String(node.effect)}'.`);
+                add(`${path}.effect`, "tool_effect_mismatch", `Tool '${node.tool}' has canonical effect '${canonicalEffect}', not '${String(node.effect)}'. Set node.effect to '${canonicalEffect}'.`);
             }
         }
     }
@@ -353,6 +406,21 @@ function lintToolNode(node, path, add, scope, options) {
     }
     validateOptionalMaxCredits(node.max_credits, `${path}.max_credits`, add);
     validateValueRefRecord(node.params, `${path}.params`, add, scope);
+    if (hasPayloadSource) {
+        validatePureFunctionSource(node.payload_source, `${path}.payload_source`, (issuePath, _code, message) => add(issuePath, "unsafe_payload_source", message));
+        if (isRecord(node.params) && Object.keys(node.params).length > 0) {
+            add(`${path}.params`, "ambiguous_tool_inputs", "A tool node cannot use mapped params and payload_source at the same time.");
+        }
+    }
+    else if (node.payload_source !== undefined) {
+        add(`${path}.payload_source`, "unsafe_payload_source", "Tool payload_source must be a string.");
+    }
+    validateLegacyContext(node, path, add);
+}
+function validateLegacyContext(node, path, add) {
+    if (node.legacy_context !== undefined && node.legacy_context !== "v1") {
+        add(`${path}.legacy_context`, "invalid_legacy_context", "Imported node legacy_context must be 'v1'.");
+    }
 }
 function lintSwitchNode(node, path, add, scope) {
     const cases = asArray(node.cases);