@stigmer/runner 3.11.0 → 3.11.1-dev.20260812192248

package/src/workflow-engine/__tests__/tasks/emit-event.test.ts

@@ -1,32 +1,34 @@
 import { describe, it, expect, vi, afterEach, beforeEach } from "vitest";
-import { emitEventAction, type EmitEventConfig } from "../../../activities/emit-event.js";
-
-// ─── Temporal signal-delivery mocks ──────────────────────────────────────────
-// deliverSignal dynamically imports @temporalio/client and resolves the cluster
-// coordinates through loadConfig(). We mock both so the signal path is testable
-// without a live Temporal server, and so we can assert which address it dials.
-const mockConnect = vi.fn(async (_opts: { address: string }) => ({}));
-const mockSignal = vi.fn(async () => undefined);
-const mockGetHandle = vi.fn((_id: string) => ({ signal: mockSignal }));
-const mockClientCtor = vi.fn((_opts: { connection: unknown; namespace: string }) => ({
-  workflow: { getHandle: mockGetHandle },
+import { emitEventAction, type EmitEventConfig, type SignalDeliveryTarget } from "../../../activities/emit-event.js";
+
+// ─── Server-mediated signal-delivery mocks ───────────────────────────────────
+// deliverSignal routes through StigmerClient.sendWorkflowSignal (the server's
+// SendSignal lane — oss#517). We mock the client so the signal path is testable
+// without a live server, and so we can assert the addressing, the bounded call
+// timeout, and the best-effort delivery_errors contract.
+const mockSendWorkflowSignal = vi.fn(async (
+  _executionId: string,
+  _signalName: string,
+  _payload: unknown,
+  _options?: { timeoutMs?: number },
+) => ({}));
+const mockClientCtor = vi.fn((_opts: { endpoint: string; token?: string | null }) => ({
+  sendWorkflowSignal: mockSendWorkflowSignal,
 }));
 
-vi.mock("@temporalio/client", () => ({
-  Connection: { connect: (opts: { address: string }) => mockConnect(opts) },
-  Client: vi.fn().mockImplementation((opts: { connection: unknown; namespace: string }) =>
-    mockClientCtor(opts),
+vi.mock("../../../client/stigmer-client.js", () => ({
+  StigmerClient: vi.fn().mockImplementation(
+    (opts: { endpoint: string; token?: string | null }) => mockClientCtor(opts),
   ),
 }));
 
-// Mutable so each test can vary what config.ts resolves. Mirrors the real
-// resolution where temporalAddress comes from TEMPORAL_SERVICE_ADDRESS.
-let mockTemporalAddress = "localhost:7233";
-let mockTemporalNamespace = "default";
+// Mutable so each test can vary what config.ts resolves. deliverSignal builds
+// its client from the canonical stigmerBackendEndpoint resolution.
+let mockBackendEndpoint = "http://localhost:7234";
 vi.mock("../../../config.js", () => ({
   loadConfig: () => ({
-    temporalAddress: mockTemporalAddress,
-    temporalNamespace: mockTemporalNamespace,
+    stigmerBackendEndpoint: mockBackendEndpoint,
+    stigmerToken: null,
   }),
 }));
 
@@ -260,63 +262,139 @@ describe("emitEventAction", () => {
     });
   });
 
-  describe("signal delivery (Temporal coordinates from config)", () => {
+  describe("signal delivery (server-mediated SendSignal lane)", () => {
     beforeEach(() => {
-      mockConnect.mockClear();
-      mockSignal.mockClear();
-      mockGetHandle.mockClear();
+      mockSendWorkflowSignal.mockClear();
       mockClientCtor.mockClear();
-      mockSignal.mockResolvedValue(undefined);
-      mockTemporalAddress = "localhost:7233";
-      mockTemporalNamespace = "default";
+      mockSendWorkflowSignal.mockResolvedValue({});
+      mockBackendEndpoint = "http://localhost:7234";
     });
 
-    it("dials the Temporal address resolved by config, not a hardcoded localhost", async () => {
-      // Regression for F1: deliverSignal previously read process.env.TEMPORAL_ADDRESS
-      // and fell back to localhost — diverging from the canonical
-      // TEMPORAL_SERVICE_ADDRESS the worker uses. It now goes through loadConfig().
-      mockTemporalAddress = "stigmer-temporal-frontend:7233";
-      mockTemporalNamespace = "stigmer-prod";
+    it("routes through the server resolved by config, addressed by execution_id", async () => {
+      mockBackendEndpoint = "https://api.stigmer.example.com";
 
       const config: EmitEventConfig = {
         event: { type: "approval.granted" },
         delivery: [
-          { signal: { workflow_id: "wf-abc", signal_name: "approvalResolved" } },
+          { signal: { execution_id: "wfx_01ABC", signal_name: "approval_resolved" } },
         ],
       };
 
       const result = await emitEventAction(config, "exec-1");
 
-      expect(mockConnect).toHaveBeenCalledWith({ address: "stigmer-temporal-frontend:7233" });
       expect(mockClientCtor).toHaveBeenCalledWith(
-        expect.objectContaining({ namespace: "stigmer-prod" }),
+        expect.objectContaining({ endpoint: "https://api.stigmer.example.com" }),
       );
-      expect(mockGetHandle).toHaveBeenCalledWith("wf-abc");
-      expect(mockSignal).toHaveBeenCalledTimes(1);
-      const [signalName, envelope] = mockSignal.mock.calls[0] as unknown as [
-        string,
-        Record<string, unknown>,
-      ];
-      expect(signalName).toBe("approvalResolved");
+      expect(mockSendWorkflowSignal).toHaveBeenCalledTimes(1);
+      const [executionId, signalName, envelope, options] =
+        mockSendWorkflowSignal.mock.calls[0] as unknown as [
+          string,
+          string,
+          Record<string, unknown>,
+          { timeoutMs?: number },
+        ];
+      expect(executionId).toBe("wfx_01ABC");
+      expect(signalName).toBe("approval_resolved");
       expect(envelope.type).toBe("approval.granted");
+      expect(envelope.specversion).toBe("1.0");
       expect(result.delivery_errors).toBeUndefined();
+      // Best-effort delivery must never consume the activity's 5m budget.
+      expect(options).toEqual({ timeoutMs: 30_000 });
     });
 
-    it("keeps signal delivery best-effort: failures are collected, not thrown", async () => {
-      mockSignal.mockRejectedValueOnce(new Error("temporal unavailable"));
+    it("keeps signal delivery best-effort: server refusals are collected, not thrown", async () => {
+      mockSendWorkflowSignal.mockRejectedValueOnce(
+        new Error("[failed_precondition] cannot send signal to execution in phase EXECUTION_COMPLETED"),
+      );
+
+      const config: EmitEventConfig = {
+        event: { type: "test" },
+        delivery: [
+          { signal: { execution_id: "wfx_done", signal_name: "ping" } },
+        ],
+      };
+
+      const result = await emitEventAction(config, "exec-1");
+
+      expect(result.delivery_errors).toHaveLength(1);
+      expect((result.delivery_errors as any)[0].target).toBe("signal:wfx_done/ping");
+      expect((result.delivery_errors as any)[0].error).toContain("failed_precondition");
+    });
 
+    it("refuses the pre-oss#517 workflow_id field by name, without calling the server", async () => {
       const config: EmitEventConfig = {
         event: { type: "test" },
         delivery: [
-          { signal: { workflow_id: "wf-down", signal_name: "ping" } },
+          {
+            signal: {
+              workflow_id: "workflow-exec-wfx_01ABC",
+              signal_name: "ping",
+            } as unknown as SignalDeliveryTarget,
+          },
         ],
       };
 
       const result = await emitEventAction(config, "exec-1");
 
+      expect(mockSendWorkflowSignal).not.toHaveBeenCalled();
       expect(result.delivery_errors).toHaveLength(1);
-      expect((result.delivery_errors as any)[0].target).toBe("signal:wf-down/ping");
-      expect((result.delivery_errors as any)[0].error).toContain("temporal unavailable");
+      expect((result.delivery_errors as any)[0].error).toContain("'execution_id'");
+      expect((result.delivery_errors as any)[0].error).toContain("'workflow_id' is not supported");
+    });
+
+    it("refuses a signal target missing signal_name", async () => {
+      const config: EmitEventConfig = {
+        event: { type: "test" },
+        delivery: [
+          {
+            signal: {
+              execution_id: "wfx_01ABC",
+            } as unknown as SignalDeliveryTarget,
+          },
+        ],
+      };
+
+      const result = await emitEventAction(config, "exec-1");
+
+      expect(mockSendWorkflowSignal).not.toHaveBeenCalled();
+      expect(result.delivery_errors).toHaveLength(1);
+      expect((result.delivery_errors as any)[0].error).toContain("'signal_name'");
+    });
+
+    it("reuses one client across multiple signal targets", async () => {
+      const config: EmitEventConfig = {
+        event: { type: "fanout" },
+        delivery: [
+          { signal: { execution_id: "wfx_a", signal_name: "sig_a" } },
+          { signal: { execution_id: "wfx_b", signal_name: "sig_b" } },
+        ],
+      };
+
+      const result = await emitEventAction(config, "exec-1");
+
+      expect(mockClientCtor).toHaveBeenCalledTimes(1);
+      expect(mockSendWorkflowSignal).toHaveBeenCalledTimes(2);
+      expect(result.delivery_errors).toBeUndefined();
+    });
+
+    it("constructs no client for webhook-only delivery", async () => {
+      const originalFetch = globalThis.fetch;
+      globalThis.fetch = vi.fn(() =>
+        Promise.resolve(new Response(null, { status: 200 })),
+      ) as any;
+
+      try {
+        const config: EmitEventConfig = {
+          event: { type: "test" },
+          delivery: [{ webhook: { url: "https://events.example.com" } }],
+        };
+
+        await emitEventAction(config, "exec-1");
+
+        expect(mockClientCtor).not.toHaveBeenCalled();
+      } finally {
+        globalThis.fetch = originalFetch;
+      }
     });
   });
 });

package/src/workflow-engine/resolve.ts

@@ -158,6 +158,9 @@ function parsePath(path: string): (string | number)[] {
 
 const RUNTIME_PLACEHOLDER_RE = /\$\{\.(secrets|env_vars)\.\w+\}/;
 
+/** Substitution form of {@link RUNTIME_PLACEHOLDER_RE} (global, capturing). */
+const RUNTIME_PLACEHOLDER_SUB_RE = /\$\{\.(secrets|env_vars)\.(\w+)\}/g;
+
 /**
  * Checks whether a string contains a runtime placeholder that should
  * NOT be evaluated in the workflow (deterministic) phase. These are
@@ -172,7 +175,9 @@ export function isRuntimePlaceholder(value: string): boolean {
 
 /**
  * Resolves runtime placeholders (`${.secrets.KEY}`, `${.env_vars.KEY}`)
- * in a string using values from the runtime environment map.
+ * in a string using values from the runtime environment map. Missing
+ * keys resolve to `""` — callers that must fail loudly instead use
+ * {@link resolveRuntimePlaceholdersStrict}.
  *
  * This runs in activities only — never in the workflow sandbox.
  */
@@ -181,7 +186,7 @@ export function resolveRuntimePlaceholders(
   runtimeEnv: Record<string, unknown>,
 ): string {
   return value.replace(
-    /\$\{\.(secrets|env_vars)\.(\w+)\}/g,
+    RUNTIME_PLACEHOLDER_SUB_RE,
     (_match, _ns: string, key: string) => {
       const resolved = runtimeEnv[key];
       return resolved !== undefined ? String(resolved) : "";
@@ -189,6 +194,47 @@ export function resolveRuntimePlaceholders(
   );
 }
 
+/** Thrown by {@link resolveRuntimePlaceholdersStrict} for a missing key. */
+export class RuntimePlaceholderResolutionError extends Error {
+  constructor(
+    public readonly variableName: string,
+    public readonly context?: string,
+  ) {
+    const where = context ? ` in ${context}` : "";
+    super(
+      `Unresolved runtime placeholder for "${variableName}"${where}: ` +
+        `variable is not present in the workflow's runtime environment`,
+    );
+    this.name = "RuntimePlaceholderResolutionError";
+  }
+}
+
+/**
+ * Strict variant of {@link resolveRuntimePlaceholders}: a placeholder
+ * whose key is missing from the runtime environment throws instead of
+ * resolving to `""` — a silently-empty credential produces cryptic
+ * downstream failures, so declared-value consumers (the run task's env
+ * contract) fail fast with the variable named.
+ *
+ * This runs in activities only — never in the workflow sandbox.
+ */
+export function resolveRuntimePlaceholdersStrict(
+  value: string,
+  runtimeEnv: Record<string, unknown>,
+  context?: string,
+): string {
+  return value.replace(
+    RUNTIME_PLACEHOLDER_SUB_RE,
+    (_match, _ns: string, key: string) => {
+      const resolved = runtimeEnv[key];
+      if (resolved === undefined) {
+        throw new RuntimePlaceholderResolutionError(key, context);
+      }
+      return String(resolved);
+    },
+  );
+}
+
 /**
  * Recursively resolves all runtime placeholders in a nested object.
  * Walks maps, arrays, and strings. Non-string leaves pass through.

package/src/workflows/__tests__/connect-mcp-server.test.ts

@@ -63,6 +63,7 @@ describe("ConnectMcpServerWorkflow", () => {
       expect(mockDiscoverActivity).toHaveBeenCalledWith({
         mcpServerId: "mcp-123",
         executionContextId: "ctx-abc",
+        executionContextToken: null,
         invokerIdentityAccountId: "user-1",
       });
 
@@ -88,6 +89,30 @@ describe("ConnectMcpServerWorkflow", () => {
       expect(mockDiscoverActivity).toHaveBeenCalledWith({
         mcpServerId: "mcp-min",
         executionContextId: null,
+        executionContextToken: null,
+        invokerIdentityAccountId: null,
+      });
+    });
+
+    it("forwards the payload-carried EC token to discovery (oss#535)", async () => {
+      // The OSS handler mints an execution-scoped token into the workflow
+      // input; discovery presents it on the EC read to receive decrypted
+      // credentials from the redact-by-default OSS server.
+      const { connectMcpServer } = await import("../connect-mcp-server.js");
+
+      mockDiscoverActivity.mockResolvedValue(makeDiscoveryResult({ tools: [] }));
+      mockClassifyActivity.mockResolvedValue([]);
+
+      await connectMcpServer({
+        mcp_server_id: "mcp-tok",
+        execution_context_id: "ctx-tok",
+        execution_context_token: "scoped-ec-token",
+      });
+
+      expect(mockDiscoverActivity).toHaveBeenCalledWith({
+        mcpServerId: "mcp-tok",
+        executionContextId: "ctx-tok",
+        executionContextToken: "scoped-ec-token",
         invokerIdentityAccountId: null,
       });
     });

package/src/workflows/connect-mcp-server.ts

@@ -201,6 +201,7 @@ export async function connectMcpServer(
   const discovery = await discover.DiscoverMcpServerCapabilities({
     mcpServerId: input.mcp_server_id,
     executionContextId: input.execution_context_id ?? null,
+    executionContextToken: input.execution_context_token ?? null,
     invokerIdentityAccountId: input.invoker_identity_account_id ?? null,
   });
 
@@ -288,6 +289,7 @@ export async function discoverMcpServerLegacy(
   const discovery = await discover.DiscoverMcpServerCapabilities({
     mcpServerId: input.mcp_server_id,
     executionContextId: input.execution_context_id ?? null,
+    executionContextToken: input.execution_context_token ?? null,
     invokerIdentityAccountId: input.invoker_identity_account_id ?? null,
   });
 

package/src/workflows/types.ts

@@ -19,6 +19,14 @@
 export interface ConnectMcpServerWorkflowInput {
   mcp_server_id: string;
   execution_context_id?: string | null;
+  /**
+   * Execution-scoped token for reading the connect ExecutionContext's
+   * decrypted credentials (oss#535). Populated by the OSS Go handler, whose
+   * EC read RPCs redact secrets for tokenless callers; absent on cloud,
+   * where the discovery activity's ambient connect_sandbox credential
+   * decrypts on its own.
+   */
+  execution_context_token?: string | null;
   invoker_identity_account_id?: string | null;
 }
 

package/dist/activities/execute-cursor/mcp-config.d.ts

@@ -1,30 +0,0 @@
-/**
- * Cursor-specific MCP config mapping.
- *
- * Converts harness-agnostic ResolvedMcpServer into the Cursor SDK's
- * McpServerConfig shape for Agent.create(). The resolution logic lives
- * in shared/mcp-resolver.ts; this module only handles the final transform.
- */
-import type { ResolvedMcpServer } from "../../shared/mcp-resolver.js";
-export type { ResolvedMcpServer, McpResolutionResult } from "../../shared/mcp-resolver.js";
-export { resolveMcpServers, extractMcpServerSlugs, PlaceholderResolutionError, } from "../../shared/mcp-resolver.js";
-/**
- * Cursor SDK MCP server config shape (matches @cursor/sdk McpServerConfig).
- * Defined here to avoid tight coupling to the SDK's internal types.
- */
-export type CursorMcpServerConfig = {
-    type?: "stdio";
-    command: string;
-    args?: string[];
-    env?: Record<string, string>;
-    cwd?: string;
-} | {
-    type?: "http" | "sse";
-    url: string;
-    headers?: Record<string, string>;
-};
-/**
- * Transform resolved MCP servers into the Cursor SDK's mcpServers config
- * for Agent.create().
- */
-export declare function toCursorMcpConfig(servers: ResolvedMcpServer[]): Record<string, CursorMcpServerConfig>;

package/dist/activities/execute-cursor/mcp-config.js

@@ -1,39 +0,0 @@
-/**
- * Cursor-specific MCP config mapping.
- *
- * Converts harness-agnostic ResolvedMcpServer into the Cursor SDK's
- * McpServerConfig shape for Agent.create(). The resolution logic lives
- * in shared/mcp-resolver.ts; this module only handles the final transform.
- */
-export { resolveMcpServers, extractMcpServerSlugs, PlaceholderResolutionError, } from "../../shared/mcp-resolver.js";
-/**
- * Transform resolved MCP servers into the Cursor SDK's mcpServers config
- * for Agent.create().
- */
-export function toCursorMcpConfig(servers) {
-    const result = {};
-    for (const server of servers) {
-        if (server.connectionType === "stdio") {
-            if (!server.command)
-                continue;
-            result[server.slug] = {
-                type: "stdio",
-                command: server.command,
-                args: server.args,
-                env: server.env,
-                cwd: server.cwd,
-            };
-        }
-        else {
-            if (!server.url)
-                continue;
-            result[server.slug] = {
-                type: server.connectionType,
-                url: server.url,
-                headers: server.headers,
-            };
-        }
-    }
-    return result;
-}
-//# sourceMappingURL=mcp-config.js.map

package/dist/activities/execute-cursor/mcp-config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mcp-config.js","sourceRoot":"","sources":["../../../src/activities/execute-cursor/mcp-config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AAoBtC;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA4B;IAE5B,MAAM,MAAM,GAA0C,EAAE,CAAC;IAEzD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,SAAS;YAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG;gBACpB,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,GAAG,EAAE,MAAM,CAAC,GAAG;aAChB,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,GAAG;gBAAE,SAAS;YAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG;gBACpB,IAAI,EAAE,MAAM,CAAC,cAAc;gBAC3B,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,OAAO,EAAE,MAAM,CAAC,OAAO;aACxB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/src/activities/execute-cursor/mcp-config.ts

@@ -1,66 +0,0 @@
-/**
- * Cursor-specific MCP config mapping.
- *
- * Converts harness-agnostic ResolvedMcpServer into the Cursor SDK's
- * McpServerConfig shape for Agent.create(). The resolution logic lives
- * in shared/mcp-resolver.ts; this module only handles the final transform.
- */
-
-import type { ResolvedMcpServer } from "../../shared/mcp-resolver.js";
-
-export type { ResolvedMcpServer, McpResolutionResult } from "../../shared/mcp-resolver.js";
-export {
-  resolveMcpServers,
-  extractMcpServerSlugs,
-  PlaceholderResolutionError,
-} from "../../shared/mcp-resolver.js";
-
-/**
- * Cursor SDK MCP server config shape (matches @cursor/sdk McpServerConfig).
- * Defined here to avoid tight coupling to the SDK's internal types.
- */
-export type CursorMcpServerConfig =
-  | {
-      type?: "stdio";
-      command: string;
-      args?: string[];
-      env?: Record<string, string>;
-      cwd?: string;
-    }
-  | {
-      type?: "http" | "sse";
-      url: string;
-      headers?: Record<string, string>;
-    };
-
-/**
- * Transform resolved MCP servers into the Cursor SDK's mcpServers config
- * for Agent.create().
- */
-export function toCursorMcpConfig(
-  servers: ResolvedMcpServer[],
-): Record<string, CursorMcpServerConfig> {
-  const result: Record<string, CursorMcpServerConfig> = {};
-
-  for (const server of servers) {
-    if (server.connectionType === "stdio") {
-      if (!server.command) continue;
-      result[server.slug] = {
-        type: "stdio",
-        command: server.command,
-        args: server.args,
-        env: server.env,
-        cwd: server.cwd,
-      };
-    } else {
-      if (!server.url) continue;
-      result[server.slug] = {
-        type: server.connectionType,
-        url: server.url,
-        headers: server.headers,
-      };
-    }
-  }
-
-  return result;
-}