@stigmer/cli 3.12.3 → 3.12.5

package/src/resources/skill.ts

@@ -8,10 +8,8 @@
 import { readdirSync, readFileSync, statSync } from "node:fs";
 import { join, relative, resolve } from "node:path";
 import { create } from "@bufbuild/protobuf";
-import { Code, ConnectError } from "@connectrpc/connect";
 import type { Skill } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
-import type { PushSkillRequest } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/io_pb";
-import { CreateSkillArtifactUploadUrlRequestSchema, PushSkillRequestSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/io_pb";
+import { PushSkillRequestSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/io_pb";
 import { GitProvenanceSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/status_pb";
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { UpdateVisibilityInputSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
@@ -322,67 +320,10 @@ export function analyzeDryRun(dir: string, options: IgnoreOptions): DryRunAnalys
   return { stats, patternSources, sampleIgnored, sampleIncluded };
 }
 
-/**
- * Largest artifact pushed inline in the gRPC request (#675). The server's
- * transport cap is 10MB for the WHOLE message, so the artifact leaves 64KB
- * of headroom for the request envelope (org, tag, provenance, framing).
- * Mirrors the Go SDK's maxInlineArtifactBytes.
- */
-const MAX_INLINE_ARTIFACT_BYTES = 10 * 1024 * 1024 - 64 * 1024;
-
-/**
- * Push, routing the artifact by size (#675): small artifacts travel inline
- * in the request (one round trip, unchanged behavior); larger ones are
- * staged over HTTP via createArtifactUploadUrl — a capability URL, so no
- * auth header — and pushed by reference. The 100MB skill limit therefore
- * no longer collides with the 10MB gRPC message cap.
- */
-export async function pushRouted(client: Stigmer, request: PushSkillRequest): Promise<Skill> {
-  if (request.artifact.length <= MAX_INLINE_ARTIFACT_BYTES) {
-    return client.skill.push(request);
-  }
-
-  let minted;
-  try {
-    minted = await client.skill.createArtifactUploadUrl(
-      create(CreateSkillArtifactUploadUrlRequestSchema, {
-        org: request.org,
-        sizeBytes: BigInt(request.artifact.length),
-      }),
-    );
-  } catch (err) {
-    if (err instanceof ConnectError && err.code === Code.Unimplemented) {
-      // Pre-transfer-lane server: an artifact this size physically cannot
-      // travel inline. Say so instead of surfacing the raw transport error.
-      throw new UsageError(
-        `skill artifact is ${formatBytes(request.artifact.length)}, above the ~10MB gRPC message cap, ` +
-          "and this server does not support the HTTP artifact transfer lane.\n\n" +
-          "Upgrade stigmer-server to push skills of this size.",
-      );
-    }
-    throw err;
-  }
-
-  const resp = await fetch(minted.url, {
-    method: "PUT",
-    // Buffer keeps undici's BodyInit typing happy where a bare Uint8Array
-    // view does not (Node-only code path, so Buffer is always available).
-    body: Buffer.from(request.artifact),
-    headers: { "content-type": "application/zip" },
-  });
-  if (!resp.ok) {
-    const detail = (await resp.text().catch(() => "")).slice(0, 512).trim();
-    throw new Error(`skill artifact upload rejected with HTTP ${resp.status}${detail === "" ? "" : `: ${detail}`}`);
-  }
-
-  // Same request, artifact traveling by reference instead of by value.
-  const byRef = create(PushSkillRequestSchema, {
-    ...request,
-    artifact: new Uint8Array(0),
-    artifactUploadRef: minted.artifactUploadRef,
-  });
-  return client.skill.push(byRef);
-}
+// Size-routed push (#675) moved down into the SDK (stigmer#701): the
+// Stigmer client's `skill.push` routes large artifacts over the HTTP
+// transfer lane itself, so the CLI — like every other SDK consumer — just
+// calls push. See sdk/typescript/src/skill.ts (RoutedSkillClient).
 
 /** Push a skill from a local directory. Git provenance is auto-detected. */
 export async function pushSkill(
@@ -410,7 +351,7 @@ export async function pushSkill(
     message,
     gitProvenance: provenance,
   });
-  const response = await pushRouted(client, request);
+  const response = await client.skill.push(request);
   const applied = await applyDeclaredVisibility(client, response, visibility);
   return toResult(applied, name, message, stats.totalSize, visibility);
 }
@@ -452,7 +393,7 @@ export async function pushSkillFromClone(
     message: params.message,
     gitProvenance: provenance,
   });
-  const response = await pushRouted(client, request);
+  const response = await client.skill.push(request);
   const applied = await applyDeclaredVisibility(client, response, visibility);
   return toResult(applied, name, params.message, stats.totalSize, visibility);
 }
@@ -540,7 +481,7 @@ export async function pushSkillFromArchive(
   });
   // Size-routed like every other push path (#675): pre-packaged archives are
   // the release-pipeline lane, exactly where content-heavy skills come from.
-  const response = await pushRouted(client, request);
+  const response = await client.skill.push(request);
   const applied = await applyDeclaredVisibility(client, response, archive.meta.visibility);
   return toResult(applied, archive.meta.name, message, archive.totalSize, archive.meta.visibility);
 }

package/src/resources/stream/events.ts

@@ -1,17 +1,19 @@
 // The sealed event model for the headless snapshot differ.
 //
-// Mirrors Go's pkg/executiontui.Event family (events.go). The differ projects
-// each AgentExecution snapshot into a sequence of these discrete events; the
+// Inherited from the retired Go CLI's pkg/executiontui.Event family (deleted
+// with the TypeScript migration, PR #203). The differ projects each
+// AgentExecution snapshot into a sequence of these discrete events; the
 // NDJSON and plaintext renderers consume them. The Ink TTY path does NOT use
-// this model — it renders from full snapshots via @stigmer/react.
+// this model — it renders from full snapshots via @stigmer/ink.
 //
-// `kind` is the discriminant. The NDJSON renderer maps each kind to Go's exact
-// wire taxonomy (run_stream_json.go), so kinds are deliberately 1:1 with the Go
-// event types rather than the wire strings.
+// `kind` is the discriminant. The NDJSON renderer preserves the retired Go
+// CLI's exact wire taxonomy (its run_stream_json.go) — that output is a
+// machine contract consumers may parse — so kinds are deliberately 1:1 with
+// the original event types rather than the wire strings.
 
 import type { JsonObject } from "@bufbuild/protobuf";
 
-/** A tool call projected for rendering. Mirrors toolrender.ToolCallInfo. */
+/** A tool call projected for rendering. Shape inherited from the retired Go CLI's toolrender.ToolCallInfo. */
 export interface ToolCallInfo {
   readonly id: string;
   readonly name: string;

package/src/resources/stream/render-plaintext.test.ts

@@ -39,6 +39,57 @@ describe("PlaintextRenderer", () => {
     expect(status).toContain("✗ shell: exploded");
   });
 
+  it("titles shell status lines with the model-authored intent when present (stigmer#276)", () => {
+    const { status } = render([
+      {
+        kind: "toolRunning",
+        toolCallId: "t1",
+        subAgentId: "",
+        toolCall: toolInfo({
+          name: "execute",
+          status: "running",
+          args: { command: "npx vitest run src/parser", description: "Run unit tests for the parser" },
+        }),
+      },
+      {
+        kind: "toolCompleted",
+        toolCallId: "t1",
+        subAgentId: "",
+        toolCall: toolInfo({
+          name: "execute",
+          args: { command: "npx vitest run src/parser", description: "Run unit tests for the parser" },
+        }),
+      },
+    ]);
+    expect(status).toContain("⠋ Run unit tests for the parser");
+    expect(status).toContain("✓ Run unit tests for the parser");
+    expect(status).not.toContain("execute");
+  });
+
+  it("keeps the raw tool name when there is no intent, and never titles non-shell tools from description", () => {
+    const { status } = render([
+      {
+        kind: "toolCompleted",
+        toolCallId: "t1",
+        subAgentId: "",
+        toolCall: toolInfo({ name: "execute", args: { command: "ls" } }),
+      },
+      {
+        kind: "toolCompleted",
+        toolCallId: "t2",
+        subAgentId: "",
+        toolCall: toolInfo({
+          name: "task",
+          args: { description: "general-purpose research", prompt: "Find the docs" },
+        }),
+      },
+    ]);
+    // A task tool's description is the sub-agent subject, never a row title.
+    expect(status).toContain("✓ execute");
+    expect(status).toContain("✓ task");
+    expect(status).not.toContain("general-purpose research");
+  });
+
   it("renders an interrupted tool with the neutral glyph, not a checkmark (issue #207)", () => {
     const { status } = render([
       { kind: "toolInterrupted", toolCallId: "t1", subAgentId: "", toolCall: toolInfo({ name: "shell", status: "interrupted" }) },

package/src/resources/stream/render-plaintext.ts

@@ -1,13 +1,14 @@
 // Plaintext headless renderer for non-TTY output (piped stdout).
 //
-// Mirrors Go's streamAgentPlainText (run_stream_plaintext.go): clean AI text to
+// Inherited from the retired Go CLI's streamAgentPlainText: clean AI text to
 // the data sink (stdout), terse tool/status lines to the status sink (stderr).
 // No ANSI, no frames. Approvals are auto-skipped — there is no keyboard here;
 // use --json for a machine-readable non-TTY stream. Phase/done/stream-error are
 // not rendered: the driver returns the outcome and the command surfaces it.
 
 import { ApprovalAction } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
-import type { ApprovalNeededEvent, StreamEvent } from "./events.js";
+import { resolveToolKindByName, shellIntentFromArgs } from "@stigmer/sdk";
+import type { ApprovalNeededEvent, StreamEvent, ToolCallInfo } from "./events.js";
 import type { HeadlessRenderer } from "./headless.js";
 import type { LineWriter } from "./render-ndjson.js";
 
@@ -40,17 +41,17 @@ export class PlaintextRenderer implements HeadlessRenderer {
         status.write(`\n> ${event.content}\n\n`);
         return;
       case "toolRunning":
-        status.write(`  ⠋ ${event.toolCall.name}\n`);
+        status.write(`  ⠋ ${toolLine(event.toolCall)}\n`);
         return;
       case "toolCompleted":
         status.write(
           event.toolCall.error !== ""
-            ? `  ✗ ${event.toolCall.name}: ${truncate(event.toolCall.error, MAX_ERROR_LEN)}\n`
-            : `  ✓ ${event.toolCall.name}\n`,
+            ? `  ✗ ${toolLine(event.toolCall)}: ${truncate(event.toolCall.error, MAX_ERROR_LEN)}\n`
+            : `  ✓ ${toolLine(event.toolCall)}\n`,
         );
         return;
       case "toolInterrupted":
-        status.write(`  ⊘ ${event.toolCall.name} (interrupted)\n`);
+        status.write(`  ⊘ ${toolLine(event.toolCall)} (interrupted)\n`);
         return;
       case "approvalNeeded":
         status.write(`  ⚠ Approval needed: ${event.toolName} (auto-skipped in non-TTY mode)\n`);
@@ -82,6 +83,23 @@ export class PlaintextRenderer implements HeadlessRenderer {
   }
 }
 
+/**
+ * The status-line label for a tool call: the model-authored intent phrase
+ * when the shell call carries one (stigmer#276) — the same convention that
+ * titles rows in the web console and the Ink TTY path — otherwise the raw
+ * tool name. Kind is resolved by name only: the snapshot projection carries
+ * neither `tool_kind` nor `mcp_server_slug`, and MCP tools never carry an
+ * intent (the fixture pins them to null), so name-lookup is sufficient here.
+ * NDJSON is deliberately untouched — it is the machine contract.
+ */
+function toolLine(toolCall: ToolCallInfo): string {
+  const intent = shellIntentFromArgs(
+    resolveToolKindByName(toolCall.name),
+    toolCall.args,
+  );
+  return intent ?? toolCall.name;
+}
+
 // Trim and ellipsize. Mirrors Go's truncate.
 function truncate(value: string, maxLen: number): string {
   const trimmed = value.trim();

package/src/resources/task-configs.test.ts

@@ -0,0 +1,98 @@
+import { fromJson, type JsonValue } from "@bufbuild/protobuf";
+import { type Workflow, WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
+import {
+  WorkflowTaskKind,
+  WorkflowTaskKindSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/enum_pb";
+import { describe, expect, it } from "vitest";
+import { decodeWorkflowTaskConfigs, TASK_CONFIG_SCHEMAS } from "./task-configs.js";
+
+function makeWorkflow(tasks: JsonValue): Workflow {
+  return fromJson(WorkflowSchema, {
+    apiVersion: "agentic.stigmer.ai/v1",
+    kind: "Workflow",
+    metadata: { name: "decode-test", org: "acme" },
+    spec: {
+      description: "task-config decode fixture",
+      document: { dsl: "1.0.0", namespace: "acme", name: "decode-test", version: "1.0.0" },
+      tasks,
+    },
+  }) as Workflow;
+}
+
+describe("TASK_CONFIG_SCHEMAS", () => {
+  // The stigmer/stigmer#353 drift class: hold the map and the proto enum to
+  // strict bidirectional equality, so a new task kind cannot ship without a
+  // CLI schema binding and a retired kind cannot linger in the map. The
+  // server-side twin of this promise is unmarshalTaskConfig's kind switch.
+  it("covers every WorkflowTaskKind exactly (bidirectional)", () => {
+    const declaredKinds = WorkflowTaskKindSchema.values
+      .map((v) => v.number as WorkflowTaskKind)
+      .filter((n) => n !== WorkflowTaskKind.workflow_task_kind_unspecified)
+      .sort((a, b) => a - b);
+    const mappedKinds = [...TASK_CONFIG_SCHEMAS.keys()].sort((a, b) => a - b);
+    expect(mappedKinds).toEqual(declaredKinds);
+  });
+});
+
+describe("decodeWorkflowTaskConfigs", () => {
+  it("rejects the string duration form a real apply rejects (the #778 repro)", () => {
+    const workflow = makeWorkflow([
+      { name: "conditional_wait", kind: "wait", task_config: { duration: "5s" } },
+    ]);
+    expect(() => decodeWorkflowTaskConfigs(workflow)).toThrow(
+      /task 'conditional_wait' \(wait\): invalid task_config/,
+    );
+  });
+
+  it("accepts the typed duration object", () => {
+    const workflow = makeWorkflow([
+      { name: "cooldown", kind: "wait", task_config: { duration: { seconds: 5 } } },
+    ]);
+    expect(() => decodeWorkflowTaskConfigs(workflow)).not.toThrow();
+  });
+
+  it("rejects unknown task_config fields, mirroring the server's strict decode", () => {
+    const workflow = makeWorkflow([
+      {
+        name: "gate",
+        kind: "human_input",
+        task_config: { prompt: "Approve?", escalation_task: "somewhere" },
+      },
+    ]);
+    expect(() => decodeWorkflowTaskConfigs(workflow)).toThrow(/gate.*human_input.*task_config/);
+  });
+
+  it("rejects values outside an enum's membership", () => {
+    const workflow = makeWorkflow([
+      {
+        name: "gate",
+        kind: "human_input",
+        task_config: { prompt: "Approve?", timeout: 60, on_timeout: "sometimes" },
+      },
+    ]);
+    expect(() => decodeWorkflowTaskConfigs(workflow)).toThrow(/gate.*invalid task_config/);
+  });
+
+  it("accepts the agent_call DSL shorthands a real apply accepts (never stricter)", () => {
+    const workflow = makeWorkflow([
+      {
+        name: "review",
+        kind: "agent_call",
+        task_config: {
+          agent: "acme/code-reviewer",
+          message: "Review ${ $context.pr.diff }",
+          harness: "cursor",
+          run_config: { model_name: "composer-2.5", service_tier: "fast" },
+          environment_refs: [{ slug: "shared-secrets" }],
+        },
+      },
+    ]);
+    expect(() => decodeWorkflowTaskConfigs(workflow)).not.toThrow();
+  });
+
+  it("skips tasks without a task_config (protovalidate territory, not decode truth)", () => {
+    const workflow = makeWorkflow([{ name: "bare", kind: "set_vars" }]);
+    expect(() => decodeWorkflowTaskConfigs(workflow)).not.toThrow();
+  });
+});

package/src/resources/task-configs.ts

@@ -0,0 +1,150 @@
+// Typed decode of workflow task_config blocks — the offline twin of the
+// server's `unmarshalTaskConfig` (backend/services/stigmer-server/pkg/domain/
+// workflow/converter/unmarshal.go).
+//
+// The Workflow proto models `task_config` as an open google.protobuf.Struct
+// discriminated by `kind`, so the top-level schema decode accepts ANY config
+// payload; a real apply then decodes it into the kind's typed message and
+// rejects what does not fit. Before this module, `stigmer validate` and
+// `apply --dry-run` reported "valid" for configs a real apply refuses
+// (stigmer/stigmer#778).
+//
+// Scope is decode-truth only: field shapes, types, enum membership, unknown
+// fields. Semantic validation (cross-task references, expression namespaces,
+// model registry, protovalidate required-field rules) remains the server's
+// authority via `validateSpec`.
+
+import { type DescMessage, fromJson, type JsonValue } from "@bufbuild/protobuf";
+import type { Workflow } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
+import { WorkflowTaskKind } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/enum_pb";
+import { AgentCallTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/agent_call_pb";
+import { CallActivityTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/call_activity_pb";
+import { EmitEventTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/emit_event_pb";
+import { EvalTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/eval_pb";
+import { ForTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/for_pb";
+import { ForkTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/fork_pb";
+import { GrpcCallTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/grpc_call_pb";
+import { HttpCallTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/http_call_pb";
+import { HumanInputTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/human_input_pb";
+import { ListenTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/listen_pb";
+import { LlmCallTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/llm_call_pb";
+import { NotificationTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/notification_pb";
+import { RaiseTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/raise_pb";
+import { RunTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/run_pb";
+import { SetTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/set_pb";
+import { SwitchTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/switch_pb";
+import { TransformTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/transform_pb";
+import { TryTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/try_pb";
+import { ValidateTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/validate_pb";
+import { WaitTaskConfigSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/tasks/wait_pb";
+
+// Exported for the drift test (task-configs.test.ts), which holds this map and
+// the WorkflowTaskKind enum descriptor to strict bidirectional equality — the
+// stigmer/stigmer#353 drift class: a new task kind cannot ship without a CLI
+// schema binding, and a retired kind cannot linger here. The entries mirror
+// the server's `unmarshalTaskConfig` kind switch one-for-one.
+export const TASK_CONFIG_SCHEMAS: ReadonlyMap<WorkflowTaskKind, DescMessage> = new Map<
+  WorkflowTaskKind,
+  DescMessage
+>([
+  [WorkflowTaskKind.set_vars, SetTaskConfigSchema],
+  [WorkflowTaskKind.http_call, HttpCallTaskConfigSchema],
+  [WorkflowTaskKind.grpc_call, GrpcCallTaskConfigSchema],
+  [WorkflowTaskKind.switch_case, SwitchTaskConfigSchema],
+  [WorkflowTaskKind.for_each, ForTaskConfigSchema],
+  [WorkflowTaskKind.fork, ForkTaskConfigSchema],
+  [WorkflowTaskKind.try_catch, TryTaskConfigSchema],
+  [WorkflowTaskKind.listen, ListenTaskConfigSchema],
+  [WorkflowTaskKind.wait, WaitTaskConfigSchema],
+  [WorkflowTaskKind.activity_call, CallActivityTaskConfigSchema],
+  [WorkflowTaskKind.raise_error, RaiseTaskConfigSchema],
+  [WorkflowTaskKind.run_workflow, RunTaskConfigSchema],
+  [WorkflowTaskKind.agent_call, AgentCallTaskConfigSchema],
+  [WorkflowTaskKind.llm_call, LlmCallTaskConfigSchema],
+  [WorkflowTaskKind.transform, TransformTaskConfigSchema],
+  [WorkflowTaskKind.human_input, HumanInputTaskConfigSchema],
+  [WorkflowTaskKind.validate, ValidateTaskConfigSchema],
+  [WorkflowTaskKind.emit_event, EmitEventTaskConfigSchema],
+  [WorkflowTaskKind.notification, NotificationTaskConfigSchema],
+  [WorkflowTaskKind.eval, EvalTaskConfigSchema],
+]);
+
+/**
+ * Decodes every task's `task_config` into its kind's typed proto message,
+ * throwing on the first config a real apply would reject. Runs on the decoded
+ * Workflow message (after the top-level schema decode), so snake_case and
+ * json-name spellings are already normalized.
+ *
+ * A task with no `task_config` is skipped: its absence is a protovalidate
+ * required-field violation, which is the server's layer, not decode-truth.
+ */
+export function decodeWorkflowTaskConfigs(workflow: Workflow): void {
+  for (const task of workflow.spec?.tasks ?? []) {
+    if (task.taskConfig === undefined) continue;
+    const schema = TASK_CONFIG_SCHEMAS.get(task.kind);
+    if (schema === undefined) continue; // unspecified/unknown kind — the server's layer reports it
+
+    // protobuf-es represents google.protobuf.Struct fields as plain JSON, so
+    // the Struct's content feeds the per-kind decode directly.
+    const config = normalizeTaskConfigShorthands(task.kind, task.taskConfig);
+    try {
+      fromJson(schema, config, { ignoreUnknownFields: false });
+    } catch (err) {
+      throw new Error(
+        `task '${task.name}' (${WorkflowTaskKind[task.kind]}): invalid task_config: ${(err as Error).message}`,
+      );
+    }
+  }
+}
+
+/**
+ * Rewrites user-friendly DSL forms to the shapes the proto decode expects —
+ * the twin of the server's `normalizeEnumShorthands` (unmarshal.go): agent_call
+ * harness shorthands ("cursor" → "HARNESS_CURSOR"), run_config service-tier
+ * shorthands ("fast" → "SERVICE_TIER_FAST"), and the environment_refs kind
+ * default (an omitted kind means environment). Without this twin the offline
+ * decode would be STRICTER than a real apply and fail valid manifests.
+ */
+function normalizeTaskConfigShorthands(kind: WorkflowTaskKind, config: JsonValue): JsonValue {
+  if (kind !== WorkflowTaskKind.agent_call || !isJsonObject(config)) {
+    return config;
+  }
+
+  const normalized: Record<string, JsonValue> = { ...config };
+
+  if (typeof normalized.harness === "string") {
+    const harness = HARNESS_SHORTHANDS[normalized.harness.toLowerCase()];
+    if (harness !== undefined) normalized.harness = harness;
+  }
+
+  if (isJsonObject(normalized.run_config)) {
+    const runConfig: Record<string, JsonValue> = { ...normalized.run_config };
+    if (typeof runConfig.service_tier === "string") {
+      const tier = SERVICE_TIER_SHORTHANDS[runConfig.service_tier.toLowerCase()];
+      if (tier !== undefined) runConfig.service_tier = tier;
+    }
+    normalized.run_config = runConfig;
+  }
+
+  if (Array.isArray(normalized.environment_refs)) {
+    normalized.environment_refs = normalized.environment_refs.map((ref) =>
+      isJsonObject(ref) && ref.kind === undefined ? { ...ref, kind: "environment" } : ref,
+    );
+  }
+
+  return normalized;
+}
+
+const HARNESS_SHORTHANDS: Record<string, string> = {
+  native: "HARNESS_NATIVE",
+  cursor: "HARNESS_CURSOR",
+};
+
+const SERVICE_TIER_SHORTHANDS: Record<string, string> = {
+  standard: "SERVICE_TIER_STANDARD",
+  fast: "SERVICE_TIER_FAST",
+};
+
+function isJsonObject(value: JsonValue | undefined): value is Record<string, JsonValue> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/src/resources/validate.test.ts

@@ -1,3 +1,4 @@
+import type { JsonValue } from "@bufbuild/protobuf";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { describe, expect, it } from "vitest";
 import { schemaForValidate, validateDocument } from "./validate.js";
@@ -51,4 +52,29 @@ describe("validateDocument", () => {
       }),
     ).toThrow();
   });
+
+  // The stigmer/stigmer#778 wiring pin: task_config blocks are typed per kind,
+  // so validate rejects what a real apply rejects instead of waving any Struct
+  // payload through. Decode behavior itself is pinned in task-configs.test.ts.
+  it("decodes workflow task_config blocks per kind", () => {
+    const workflowSchema = schemaForValidate(ApiResourceKind.workflow);
+    if (workflowSchema === undefined) throw new Error("workflow schema unavailable");
+
+    const workflowDoc = (taskConfig: JsonValue): JsonValue => ({
+      apiVersion: "agentic.stigmer.ai/v1",
+      kind: "Workflow",
+      metadata: { name: "wf", org: "acme" },
+      spec: {
+        document: { dsl: "1.0.0", namespace: "acme", name: "wf", version: "1.0.0" },
+        tasks: [{ name: "conditional_wait", kind: "wait", task_config: taskConfig }],
+      },
+    });
+
+    expect(() => validateDocument(workflowSchema, workflowDoc({ duration: "5s" }))).toThrow(
+      /conditional_wait.*invalid task_config/,
+    );
+    expect(() =>
+      validateDocument(workflowSchema, workflowDoc({ duration: { seconds: 5 } })),
+    ).not.toThrow();
+  });
 });

package/src/resources/validate.ts

@@ -8,9 +8,10 @@
 import { type DescMessage, fromJson, type JsonValue } from "@bufbuild/protobuf";
 import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
-import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
+import { type Workflow, WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { ProjectSchema } from "@stigmer/protos/ai/stigmer/tenancy/project/v1/api_pb";
+import { decodeWorkflowTaskConfigs } from "./task-configs.js";
 
 // Exported for the verb/dispatch conformance suite (registry/registry.test.ts),
 // which holds this map and the matrix's Verb.Validate promises to strict
@@ -31,5 +32,12 @@ export function schemaForValidate(kind: ApiResourceKind): DescMessage | undefine
 export function validateDocument(schema: DescMessage, document: JsonValue): void {
   // ignoreUnknownFields mirrors the server's lenient unmarshal: forward-compat
   // fields a newer server adds should not fail a slightly older CLI.
-  fromJson(schema, document, { ignoreUnknownFields: true });
+  const message = fromJson(schema, document, { ignoreUnknownFields: true });
+
+  // Workflows carry per-kind typed configs inside an open Struct that the
+  // top-level decode cannot see into — decode them too, so validate stops
+  // passing configs a real apply rejects (stigmer/stigmer#778).
+  if (schema === WorkflowSchema) {
+    decodeWorkflowTaskConfigs(message as Workflow);
+  }
 }

package/src/resources/session.test.ts

@@ -1,48 +0,0 @@
-import { create } from "@bufbuild/protobuf";
-import { SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
-import { SessionListSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/io_pb";
-import { describe, expect, it } from "vitest";
-import { isSessionAlias, renderSessionList } from "./session.js";
-
-describe("isSessionAlias", () => {
-  it.each([
-    ["session", true],
-    ["sessions", true],
-    ["  Session ", true],
-    ["execution", false],
-    ["agent", false],
-  ])("%j -> %s", (type, expected) => {
-    expect(isSessionAlias(type)).toBe(expected);
-  });
-});
-
-describe("renderSessionList", () => {
-  const list = create(SessionListSchema, {
-    totalPages: 1,
-    entries: [
-      create(SessionSchema, {
-        metadata: { id: "ses_1" },
-        spec: { agentInstanceId: "agi_1", subject: "Fix the build" },
-      }),
-    ],
-  });
-  const result = { schema: SessionListSchema, message: list };
-
-  it("renders the full list envelope as protojson for json", () => {
-    const json = JSON.parse(renderSessionList(result, "json"));
-    expect(json.entries[0].metadata.id).toBe("ses_1");
-  });
-
-  it("renders a table with the session columns", () => {
-    const table = renderSessionList(result, "table");
-    expect(table).toContain("SESSION ID");
-    expect(table).toContain("ses_1");
-    expect(table).toContain("agi_1");
-    expect(table).toContain("Fix the build");
-  });
-
-  it("renders an empty notice for no sessions", () => {
-    const empty = { schema: SessionListSchema, message: create(SessionListSchema, {}) };
-    expect(renderSessionList(empty, "table").toLowerCase()).toContain("no sessions");
-  });
-});