@shipfox/api-definitions 11.0.0 → 12.0.0

package/src/core/workflow-model/normalize-jobs.ts

@@ -2,8 +2,13 @@ import type {AgentValidationCatalog} from '@shipfox/api-agent-dto/inter-module';
 import {
   type AvailabilitySite,
   buildTypedRootsEnvironment,
+  classifyShellCodePosition,
   type ExpressionType,
   type ExpressionTypeEnvironment,
+  hoistPlannedRunCommand,
+  type ShellReevaluatingConstruct,
+  type UnsafeRunInterpolation,
+  UnsafeRunInterpolationError,
   type WorkflowJobTypeOverlay,
   type WorkflowStepTypeOverlay,
 } from '@shipfox/expression';
@@ -24,17 +29,22 @@ import type {
   WorkflowEnvTemplates,
   WorkflowFieldTemplate,
   WorkflowModelAgentStep,
+  WorkflowModelCheckoutStep,
   WorkflowModelJob,
   WorkflowModelRunStep,
   WorkflowModelStep,
+  WorkflowModelStepCheckout,
   WorkflowOutputTemplates,
   WorkflowStepSourceLocationMap,
 } from '../entities/workflow-model.js';
-import type {WorkflowModelValidationIssue} from './invalid-workflow-model-error.js';
+import type {
+  WorkflowModelValidationIssue,
+  WorkflowModelValidationIssuePathSegment,
+} from './invalid-workflow-model-error.js';
 import {normalizeAgentIntegrations} from './normalize-agent-integrations.js';
 import {normalizeEnv} from './normalize-env.js';
 import {normalizeIfCondition} from './normalize-if-condition.js';
-import {normalizeJobCheckout} from './normalize-job-checkout.js';
+import {normalizeCheckout, normalizeJobCheckout} from './normalize-job-checkout.js';
 import {normalizeJobListening} from './normalize-job-listening.js';
 import {normalizeJobSuccess} from './normalize-job-success.js';
 import {normalizeNeeds} from './normalize-needs.js';
@@ -43,6 +53,7 @@ import {normalizeStepOutputs} from './normalize-step-outputs.js';
 import {parseDurationMs} from './parse-duration-ms.js';
 import {parseInterpolationField} from './parse-interpolation-field.js';
 import {stableId} from './stable-id.js';
+import {unescapeLiteralName, validateLiteralName} from './validate-literal-name.js';
 import {issue} from './validation-issue.js';
 
 export interface NormalizeContext {
@@ -178,6 +189,8 @@ function normalizeJob(params: {
     sourceName: params.sourceName,
     jobId: id,
     job: params.job,
+    workflowEnvKeys: Object.keys(params.document.env ?? {}),
+    jobEnvKeys: Object.keys(params.job.env ?? {}),
     issues: params.issues,
     stepSourceLocations: params.stepSourceLocations,
     fillSite: stepFillSite,
@@ -194,7 +207,9 @@ function normalizeJob(params: {
     issues: params.issues,
     defaultRunnerLabels: params.context.defaultRunnerLabels,
   });
-  const checkout = normalizeJobCheckout(params.job.checkout);
+  const checkout = normalizeJobCheckout({
+    checkout: params.job.checkout,
+  });
   const jobEnv = normalizeEnv({
     env: params.job.env,
     path: ['jobs', params.sourceName, 'env'],
@@ -212,7 +227,6 @@ function normalizeJob(params: {
   const condition = normalizeIfCondition({
     field: 'job.if',
     source: params.job.if,
-    site: 'job-activation',
     path: ['jobs', params.sourceName, 'if'],
     invalidCode: 'invalid-job-if',
     invalidMessage: 'Job if must be a valid wrapped CEL boolean expression.',
@@ -242,17 +256,29 @@ function normalizeJob(params: {
     issues: params.issues,
     allowedJobReferences,
   });
-  const name =
-    params.job.name === undefined
+  if (params.job.name !== undefined) {
+    validateLiteralName({
+      field: 'job.name',
+      dynamicField: 'execution_name',
+      source: params.job.name,
+      path: ['jobs', params.sourceName, 'name'],
+      message: 'Job name must be literal. Move runtime interpolation to execution_name.',
+      issues: params.issues,
+    });
+  }
+  const name = params.job.name === undefined ? undefined : unescapeLiteralName(params.job.name);
+  const executionName =
+    params.job.execution_name === undefined
       ? undefined
       : (parseInterpolationField({
-          field: 'job.name',
-          source: params.job.name,
-          path: ['jobs', params.sourceName, 'name'],
+          field: 'job.execution_name',
+          source: params.job.execution_name,
+          path: ['jobs', params.sourceName, 'execution_name'],
           issues: params.issues,
+          fillSite: 'execution-creation',
           allowedJobReferences,
           typeOverlay: upstreamJobsTypeOverlay,
-        }) ?? [{kind: 'literal' as const, value: params.job.name}]);
+        }) ?? [{kind: 'literal' as const, value: params.job.execution_name}]);
 
   return {
     id,
@@ -268,6 +294,7 @@ function normalizeJob(params: {
     ...(executionTimeoutMs === undefined ? {} : {executionTimeoutMs}),
     ...(listening === undefined ? {} : {listening}),
     ...(name === undefined ? {} : {name}),
+    ...(executionName === undefined ? {} : {executionName}),
     ...jobEnv,
     dependencies,
     steps,
@@ -434,6 +461,8 @@ function normalizeJobSteps(params: {
   sourceName: string;
   jobId: string;
   job: WorkflowDocumentJob;
+  workflowEnvKeys: readonly string[];
+  jobEnvKeys: readonly string[];
   issues: WorkflowModelValidationIssue[];
   stepSourceLocations: WorkflowStepSourceLocationMap | undefined;
   fillSite: AvailabilitySite;
@@ -445,13 +474,15 @@ function normalizeJobSteps(params: {
 }): readonly WorkflowModelStep[] {
   const usedStepIds = new Map<string, number>();
 
-  return params.job.steps.map((step, index) =>
-    normalizeStep({
+  return params.job.steps.flatMap((step, index) => {
+    const normalized = normalizeStep({
       step,
       index,
       sourceName: params.sourceName,
       jobId: params.jobId,
       allSteps: params.job.steps,
+      workflowEnvKeys: params.workflowEnvKeys,
+      jobEnvKeys: params.jobEnvKeys,
       usedStepIds,
       issues: params.issues,
       stepSourceLocations: params.stepSourceLocations,
@@ -461,8 +492,9 @@ function normalizeJobSteps(params: {
       upstreamJobs: params.upstreamJobs,
       directNeedJobs: params.directNeedJobs,
       context: params.context,
-    }),
-  );
+    });
+    return normalized === undefined ? [] : [normalized];
+  });
 }
 
 function normalizeStep(params: {
@@ -471,6 +503,8 @@ function normalizeStep(params: {
   sourceName: string;
   jobId: string;
   allSteps: readonly WorkflowDocumentStep[];
+  workflowEnvKeys: readonly string[];
+  jobEnvKeys: readonly string[];
   usedStepIds: Map<string, number>;
   issues: WorkflowModelValidationIssue[];
   stepSourceLocations: WorkflowStepSourceLocationMap | undefined;
@@ -480,7 +514,7 @@ function normalizeStep(params: {
   upstreamJobs: readonly WorkflowJobTypeOverlay[];
   directNeedJobs: readonly WorkflowJobTypeOverlay[];
   context: NormalizeContext;
-}): WorkflowModelStep {
+}): WorkflowModelStep | undefined {
   const stepKey = params.step.key;
   const stepId =
     stepKey === undefined
@@ -532,7 +566,6 @@ function normalizeStep(params: {
   const condition = normalizeIfCondition({
     field: 'step.if',
     source: params.step.if,
-    site: 'step-dispatch',
     path: ['jobs', params.sourceName, 'steps', params.index, 'if'],
     invalidCode: 'invalid-step-if',
     invalidMessage: 'Step if must be a valid wrapped CEL boolean expression.',
@@ -567,10 +600,25 @@ function normalizeStep(params: {
           allowedJobReferences: params.allowedJobReferences,
           typeOverlay,
         });
+  const workingDirectory =
+    params.step.working_directory === undefined
+      ? undefined
+      : parseInterpolationField({
+          field: 'step.working_directory',
+          source: params.step.working_directory,
+          path: ['jobs', params.sourceName, 'steps', params.index, 'working_directory'],
+          issues: params.issues,
+          fillSite: params.fillSite,
+          allowedJobReferences: params.allowedJobReferences,
+          typeOverlay,
+        });
   const stepBase = {
     id: stepId,
     ...(stepKey === undefined ? {} : {key: stepKey}),
     ...(params.step.name === undefined ? {} : {name: params.step.name}),
+    ...(params.step.working_directory === undefined
+      ? {}
+      : {workingDirectory: params.step.working_directory}),
     ...(outputs === undefined ? {} : {outputs}),
     ...(sourceLocation === undefined ? {} : {sourceLocation}),
     ...(condition === undefined ? {} : {if: condition}),
@@ -583,7 +631,10 @@ function normalizeStep(params: {
       stepBase,
       sourceName: params.sourceName,
       stepIndex: params.index,
+      workflowEnvKeys: params.workflowEnvKeys,
+      jobEnvKeys: params.jobEnvKeys,
       name,
+      workingDirectory,
       issues: params.issues,
       fillSite: params.fillSite,
       allowedJobReferences: params.allowedJobReferences,
@@ -598,6 +649,7 @@ function normalizeStep(params: {
       sourceName: params.sourceName,
       stepIndex: params.index,
       name,
+      workingDirectory,
       issues: params.issues,
       fillSite: params.fillSite,
       allowedJobReferences: params.allowedJobReferences,
@@ -606,9 +658,55 @@ function normalizeStep(params: {
     });
   }
 
-  // workflowDocumentStepSchema requires either `run` or an agent `prompt`; this
-  // keeps the model-step union honest if callers bypass the document parser.
-  throw new Error(`Workflow step "${stepId}" is neither a run nor an agent step`);
+  if (params.step.checkout !== undefined) {
+    return normalizeCheckoutStep({
+      step: params.step,
+      stepBase,
+      name,
+      sourceName: params.sourceName,
+      stepIndex: params.index,
+      issues: params.issues,
+      fillSite: params.fillSite,
+      allowedJobReferences: params.allowedJobReferences,
+      typeOverlay,
+    });
+  }
+
+  // Keep the model-step union honest if callers bypass the document parser.
+  throw new Error(`Workflow step "${stepId}" is neither a run, agent, nor checkout step`);
+}
+
+function normalizeCheckoutStep(params: {
+  step: WorkflowDocumentStep;
+  stepBase: WorkflowModelStepBaseFields;
+  name: WorkflowFieldTemplate | undefined;
+  sourceName: string;
+  stepIndex: number;
+  issues: WorkflowModelValidationIssue[];
+  fillSite: AvailabilitySite;
+  allowedJobReferences: ReadonlySet<string>;
+  typeOverlay?: ExpressionTypeEnvironment | undefined;
+}): WorkflowModelCheckoutStep {
+  const checkout = params.step.checkout;
+  if (checkout === undefined) {
+    throw new Error('Checkout step normalization requires checkout settings');
+  }
+
+  const normalizedCheckout: WorkflowModelStepCheckout = normalizeCheckout({
+    checkout,
+    issues: params.issues,
+    path: ['jobs', params.sourceName, 'steps', params.stepIndex, 'checkout'],
+    fillSite: params.fillSite,
+    allowedJobReferences: params.allowedJobReferences,
+    typeOverlay: params.typeOverlay,
+  });
+
+  return {
+    ...params.stepBase,
+    kind: 'checkout',
+    checkout: normalizedCheckout,
+    ...(params.name === undefined ? {} : {templates: {name: params.name}}),
+  };
 }
 
 function normalizeRunStep(params: {
@@ -616,7 +714,10 @@ function normalizeRunStep(params: {
   stepBase: WorkflowModelStepBaseFields;
   sourceName: string;
   stepIndex: number;
+  workflowEnvKeys: readonly string[];
+  jobEnvKeys: readonly string[];
   name: WorkflowFieldTemplate | undefined;
+  workingDirectory: WorkflowFieldTemplate | undefined;
   issues: WorkflowModelValidationIssue[];
   fillSite: AvailabilitySite;
   allowedJobReferences: ReadonlySet<string>;
@@ -643,9 +744,19 @@ function normalizeRunStep(params: {
     allowedJobReferences: params.allowedJobReferences,
     typeOverlay: params.typeOverlay,
   });
+  addReevaluatingCommandWarnings({
+    command: commandTemplate,
+    source: params.step.run,
+    workflowEnvKeys: params.workflowEnvKeys,
+    jobEnvKeys: params.jobEnvKeys,
+    stepEnvKeys: Object.keys(params.step.env ?? {}),
+    path: ['jobs', params.sourceName, 'steps', params.stepIndex, 'run'],
+    issues: params.issues,
+  });
   const templates = optionalRunStepTemplates({
     command: commandTemplate,
     name: params.name,
+    workingDirectory: params.workingDirectory,
     env: stepEnv.templates?.env,
   });
 
@@ -658,12 +769,110 @@ function normalizeRunStep(params: {
   };
 }
 
+function addReevaluatingCommandWarnings(params: {
+  command: WorkflowFieldTemplate | undefined;
+  source: string;
+  workflowEnvKeys: readonly string[];
+  jobEnvKeys: readonly string[];
+  stepEnvKeys: readonly string[];
+  path: readonly WorkflowModelValidationIssuePathSegment[];
+  issues: WorkflowModelValidationIssue[];
+}): void {
+  const envKeys = new Set([...params.workflowEnvKeys, ...params.jobEnvKeys, ...params.stepEnvKeys]);
+  let hoisted: ReturnType<typeof hoistPlannedRunCommand>;
+
+  try {
+    hoisted = hoistPlannedRunCommand({
+      field: {
+        segments: params.command ?? [{kind: 'literal', value: params.source}],
+      },
+      reservedNames: envKeys,
+    });
+  } catch (error) {
+    if (!(error instanceof UnsafeRunInterpolationError)) return;
+
+    for (const occurrence of error.occurrences) {
+      params.issues.push(
+        issue({
+          code: 're-evaluating-command',
+          message: unsafeInterpolationWarningMessage(occurrence),
+          path: params.path,
+          severity: 'warning',
+        }),
+      );
+    }
+
+    if (error.partial === undefined) return;
+    hoisted = error.partial;
+  }
+
+  try {
+    const matches = classifyShellCodePosition({
+      command: hoisted.command,
+      workflowDataNames: [...envKeys, ...hoisted.bindings.map((binding) => binding.name)],
+    }).matches;
+
+    for (const match of matches) {
+      params.issues.push(
+        issue({
+          code: 're-evaluating-command',
+          message: reevaluatingCommandWarningMessage(match.construct, match.name),
+          path: params.path,
+          severity: 'warning',
+        }),
+      );
+    }
+  } catch {
+    return;
+  }
+}
+
+function unsafeInterpolationWarningMessage(error: UnsafeRunInterpolation): string {
+  const regionLabel = {
+    single: 'single-quoted shell text',
+    double: 'double-quoted shell text',
+    'dollar-single': 'ANSI-C shell text',
+    'dollar-double': 'dollar-double-quoted shell text',
+    'paren-sub': 'command substitution',
+    arith: 'shell arithmetic',
+    backtick: 'backtick substitution',
+    'param-brace': 'shell parameter expansion',
+    heredoc: 'a heredoc',
+    'line-comment': 'a shell comment',
+    escape: 'a shell escape',
+  }[error.region];
+
+  return `Value "${error.source}" is inside ${regionLabel} and will be re-executed as code. Hoisting cannot protect it; move the interpolation to a normal quoted argument instead.`;
+}
+
+function reevaluatingCommandWarningMessage(
+  construct: ShellReevaluatingConstruct,
+  name: string,
+): string {
+  const constructLabel = {
+    eval: 'eval',
+    'sh-c': 'sh -c',
+    'bash-c': 'bash -c',
+    source: 'source',
+    let: 'let',
+    'declare-i': 'declare -i',
+    arithmetic: 'shell arithmetic',
+    awk: 'awk',
+    jq: 'jq',
+    sed: 'sed',
+    'xargs-sh-c': 'xargs sh -c',
+  }[construct];
+
+  return `Value "$${name}" is passed to ${constructLabel} and re-executed as code. Hoisting cannot protect it; pass the value to a fixed program instead.`;
+}
+
 function normalizeAgentStep(params: {
   step: WorkflowDocumentStep;
   stepBase: WorkflowModelStepBaseFields;
   sourceName: string;
   stepIndex: number;
   name: WorkflowFieldTemplate | undefined;
+  workingDirectory: WorkflowFieldTemplate | undefined;
   issues: WorkflowModelValidationIssue[];
   fillSite: AvailabilitySite;
   allowedJobReferences: ReadonlySet<string>;
@@ -707,12 +916,27 @@ function normalizeAgentStep(params: {
           allowedJobReferences: params.allowedJobReferences,
           typeOverlay: params.typeOverlay,
         });
+  const thinkingTemplate =
+    params.step.thinking === undefined
+      ? undefined
+      : parseInterpolationField({
+          field: 'agent.thinking',
+          source: params.step.thinking,
+          path: ['jobs', params.sourceName, 'steps', params.stepIndex, 'thinking'],
+          issues: params.issues,
+          fillSite: params.fillSite,
+          allowedJobReferences: params.allowedJobReferences,
+          typeOverlay: params.typeOverlay,
+        });
   validateAgentStep({
     step: params.step,
     sourceName: params.sourceName,
     stepIndex: params.stepIndex,
     issues: params.issues,
-    validateLiteralProvider: providerTemplate === undefined,
+    validateLiteralModel:
+      params.step.model !== undefined && !hasInterpolationSyntax(params.step.model),
+    validateLiteralProvider:
+      params.step.provider !== undefined && !hasInterpolationSyntax(params.step.provider),
     agentValidationCatalog: params.context.agentValidationCatalog,
   });
   const integrations = normalizeAgentIntegrations({
@@ -726,7 +950,9 @@ function normalizeAgentStep(params: {
     prompt: promptTemplate,
     model: modelTemplate,
     provider: providerTemplate,
+    thinking: thinkingTemplate,
     name: params.name,
+    workingDirectory: params.workingDirectory,
   });
 
   return {
@@ -748,47 +974,83 @@ function validateAgentStep(params: {
   sourceName: string;
   stepIndex: number;
   issues: WorkflowModelValidationIssue[];
+  validateLiteralModel: boolean;
   validateLiteralProvider: boolean;
   agentValidationCatalog: AgentValidationCatalog;
 }): void {
   validateHarnessThinking(params);
   validateHarnessTools(params);
-  if (!params.validateLiteralProvider) return;
-
   const providerId = params.step.provider;
-  if (providerId === undefined) return;
-
-  const provider = params.agentValidationCatalog.providers.find((entry) => entry.id === providerId);
   const harness = params.step.harness;
-  if (provider === undefined && harness === 'pi') return;
+  const provider =
+    providerId === undefined
+      ? undefined
+      : params.agentValidationCatalog.providers.find((entry) => entry.id === providerId);
+
+  if (params.validateLiteralProvider && providerId !== undefined) {
+    if (provider === undefined) {
+      if (harness === undefined || harness === 'pi') return;
+      params.issues.push(
+        issue({
+          code: 'invalid-provider',
+          message: `Provider "${providerId}" is not supported.`,
+          path: ['jobs', params.sourceName, 'steps', params.stepIndex, 'provider'],
+          details: {provider: providerId},
+        }),
+      );
+      return;
+    }
 
-  if (provider === undefined || provider.support_status !== 'supported') {
-    params.issues.push(
-      issue({
-        code: 'invalid-provider',
-        message: `Provider "${providerId}" is not supported.`,
-        path: ['jobs', params.sourceName, 'steps', params.stepIndex, 'provider'],
-        details: {provider: providerId},
-      }),
+    if (provider.support_status !== 'supported') {
+      params.issues.push(
+        issue({
+          code: 'invalid-provider',
+          message: `Provider "${providerId}" is not supported.`,
+          path: ['jobs', params.sourceName, 'steps', params.stepIndex, 'provider'],
+          details: {provider: providerId},
+        }),
+      );
+      return;
+    }
+
+    if (harness === undefined) return;
+
+    const descriptor = params.agentValidationCatalog.harnesses.find(
+      (entry) => entry.id === harness,
     );
-    return;
+    if (!descriptor?.supported_provider_ids.includes(providerId)) {
+      params.issues.push(
+        issue({
+          code: 'harness-provider-incompatible',
+          message: `Harness "${harness}" does not support provider: ${providerId}. Supported providers: ${descriptor?.supported_provider_ids.join(', ') ?? ''}.`,
+          path: ['jobs', params.sourceName, 'steps', params.stepIndex, 'provider'],
+          details: {
+            harness,
+            provider: providerId,
+            supportedProviders: descriptor?.supported_provider_ids ?? [],
+          },
+        }),
+      );
+      return;
+    }
   }
 
-  if (harness === undefined) return;
+  if (!params.validateLiteralModel || providerId === undefined || harness === undefined) return;
+  if (provider === undefined || provider.support_status !== 'supported') return;
+
+  const model = params.step.model;
+  if (model === undefined) return;
 
   const descriptor = params.agentValidationCatalog.harnesses.find((entry) => entry.id === harness);
-  if (descriptor?.supported_provider_ids.includes(providerId)) return;
+  const modelIds = descriptor?.model_ids_by_provider?.[providerId];
+  if (modelIds === undefined || modelIds.includes(model)) return;
 
   params.issues.push(
     issue({
-      code: 'harness-provider-incompatible',
-      message: `Harness "${harness}" does not support provider: ${providerId}. Supported providers: ${descriptor?.supported_provider_ids.join(', ') ?? ''}.`,
-      path: ['jobs', params.sourceName, 'steps', params.stepIndex, 'provider'],
-      details: {
-        harness,
-        provider: providerId,
-        supportedProviders: descriptor?.supported_provider_ids ?? [],
-      },
+      code: 'invalid-model',
+      message: `Agent model "${model}" is not available for harness "${harness}" and provider "${providerId}".`,
+      path: ['jobs', params.sourceName, 'steps', params.stepIndex, 'model'],
+      details: {harness, provider: providerId, model},
     }),
   );
 }
@@ -844,11 +1106,14 @@ function validateHarnessThinking(params: {
 }): void {
   const {harness, thinking} = params.step;
   if (harness === undefined || thinking === undefined) return;
+  // An interpolated level is only known when the step dispatches, so the agent
+  // module checks it against the resolved harness there.
+  if (hasInterpolationSyntax(thinking)) return;
 
   const supportedLevels =
     params.agentValidationCatalog.harnesses.find((entry) => entry.id === harness)
       ?.thinking_levels ?? [];
-  if (supportedLevels.includes(thinking)) return;
+  if ((supportedLevels as readonly string[]).includes(thinking)) return;
   params.issues.push(
     issue({
       code: 'harness-thinking-incompatible',
@@ -953,27 +1218,35 @@ function validateRunnerLabels(params: {
 
 type WorkflowModelStepBaseFields = Pick<
   WorkflowModelStep,
-  'id' | 'key' | 'name' | 'outputs' | 'sourceLocation' | 'gate'
+  'id' | 'key' | 'name' | 'workingDirectory' | 'outputs' | 'sourceLocation' | 'gate'
 >;
 
 function optionalRunStepTemplates(params: {
   command: WorkflowFieldTemplate | undefined;
   name: WorkflowFieldTemplate | undefined;
+  workingDirectory: WorkflowFieldTemplate | undefined;
   env: WorkflowEnvTemplates | undefined;
 }):
   | {
       command?: WorkflowFieldTemplate;
       name?: WorkflowFieldTemplate;
+      workingDirectory?: WorkflowFieldTemplate;
       env?: WorkflowEnvTemplates;
     }
   | undefined {
-  if (params.command === undefined && params.name === undefined && params.env === undefined) {
+  if (
+    params.command === undefined &&
+    params.name === undefined &&
+    params.workingDirectory === undefined &&
+    params.env === undefined
+  ) {
     return undefined;
   }
 
   return {
     ...(params.command === undefined ? {} : {command: params.command}),
     ...(params.name === undefined ? {} : {name: params.name}),
+    ...(params.workingDirectory === undefined ? {} : {workingDirectory: params.workingDirectory}),
     ...(params.env === undefined ? {} : {env: params.env}),
   };
 }
@@ -982,20 +1255,26 @@ function optionalAgentStepTemplates(params: {
   prompt: WorkflowFieldTemplate | undefined;
   model: WorkflowFieldTemplate | undefined;
   provider: WorkflowFieldTemplate | undefined;
+  thinking: WorkflowFieldTemplate | undefined;
   name: WorkflowFieldTemplate | undefined;
+  workingDirectory: WorkflowFieldTemplate | undefined;
 }):
   | {
       prompt?: WorkflowFieldTemplate;
       model?: WorkflowFieldTemplate;
       provider?: WorkflowFieldTemplate;
+      thinking?: WorkflowFieldTemplate;
       name?: WorkflowFieldTemplate;
+      workingDirectory?: WorkflowFieldTemplate;
     }
   | undefined {
   if (
     params.prompt === undefined &&
     params.model === undefined &&
     params.provider === undefined &&
-    params.name === undefined
+    params.thinking === undefined &&
+    params.name === undefined &&
+    params.workingDirectory === undefined
   ) {
     return undefined;
   }
@@ -1004,6 +1283,8 @@ function optionalAgentStepTemplates(params: {
     ...(params.prompt === undefined ? {} : {prompt: params.prompt}),
     ...(params.model === undefined ? {} : {model: params.model}),
     ...(params.provider === undefined ? {} : {provider: params.provider}),
+    ...(params.thinking === undefined ? {} : {thinking: params.thinking}),
     ...(params.name === undefined ? {} : {name: params.name}),
+    ...(params.workingDirectory === undefined ? {} : {workingDirectory: params.workingDirectory}),
   };
 }

package/src/core/workflow-model/normalize-step-gate.ts

@@ -79,7 +79,6 @@ function normalizeGateSuccess(params: {
   return validatePredicateExpression({
     field: 'step.success',
     source: params.source,
-    site: 'step-report',
     path: ['jobs', params.sourceName, 'steps', params.stepIndex, 'gate', 'success'],
     invalidCode: 'invalid-step-gate-success',
     invalidMessage: 'Step gate success must be a valid CEL boolean expression.',

package/src/core/workflow-model/normalize-triggers.ts

@@ -107,7 +107,6 @@ function validateTriggerFilter(params: {
   validatePredicateExpression({
     field: 'trigger.filter',
     source: trigger.filter,
-    site: 'ingest',
     path,
     invalidCode: 'invalid-trigger-filter',
     invalidMessage: 'Trigger filter must be a valid boolean predicate.',