@stigmer/runner 3.12.5 → 3.12.6

package/src/shared/thinking-mode.ts

@@ -0,0 +1,52 @@
+/**
+ * Harness-neutral thinking-mode semantics (stigmer/stigmer#772) — the
+ * second variant dimension alongside `shared/service-tier.ts`.
+ *
+ * The platform contract mirrors the service tier's: the thinking pin is
+ * ALWAYS explicit by the time a provider request leaves the runner.
+ * UNSPECIFIED resolves to DISABLED here and ONLY here — every upstream
+ * layer preserves the caller's raw enum so "user chose disabled" stays
+ * distinguishable from "platform default" all the way to the ledger.
+ *
+ * Unlike the fast tier, thinking is NOT separately priced: Cursor bills
+ * thinking variants at base per-token rates (ledger-verified 2026-08-15 —
+ * 277 events at exactly base; thinking+fast at exactly the fast rate).
+ * The cost of ENABLED is the extra reasoning tokens, billed as output.
+ * Selection is therefore capability-gated (registry capabilities.thinking)
+ * rather than pricing-gated, and the estimate/billing paths need no
+ * thinking-specific rates.
+ *
+ * v1 translates thinking on the Cursor harness only (the explicit
+ * `thinking` variant parameter, `execute-cursor/service-tier.ts`). No
+ * native wire mapping exists yet — create-time validation refuses ENABLED
+ * for native-harness models, mirroring the tier's #361 posture.
+ */
+
+import { ThinkingMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+/**
+ * The effective mode after platform-default resolution: never UNSPECIFIED.
+ */
+export type EffectiveThinkingMode = ThinkingMode.DISABLED | ThinkingMode.ENABLED;
+
+/**
+ * Resolve the configured mode to its effective value. The single place in
+ * the platform where UNSPECIFIED becomes DISABLED.
+ */
+export function resolveEffectiveThinkingMode(
+  configured: ThinkingMode | undefined,
+): EffectiveThinkingMode {
+  return configured === ThinkingMode.ENABLED ? ThinkingMode.ENABLED : ThinkingMode.DISABLED;
+}
+
+/** Human-readable mode label for logs and error messages. */
+export function thinkingModeLabel(mode: ThinkingMode): string {
+  switch (mode) {
+    case ThinkingMode.ENABLED:
+      return "enabled";
+    case ThinkingMode.DISABLED:
+      return "disabled";
+    default:
+      return "unspecified";
+  }
+}

package/src/workflow-engine/__tests__/loader.test.ts

@@ -1562,13 +1562,57 @@ do:
       }
     });
 
-    it("call: human_input rejects the not-implemented escalate policy at load time", () => {
+    // The escalate outcome-by-name contract (stigmer/stigmer#781): the policy
+    // loads only when the gate declares an outcome named "escalate" with
+    // `then` set — the timeout resolves to that outcome and follows its branch.
+    const escalateYamlWithOutcomes = (onTimeout: string, outcomesYaml: string) => `
+document:
+  dsl: '1.0.0'
+  name: test
+do:
+  - timedApproval:
+      call: human_input
+      with:
+        prompt: "Approve within time limit"
+        timeout: 3600
+        on_timeout: ${onTimeout}
+        outcomes:
+${outcomesYaml}
+`;
+
+    it("call: human_input accepts the escalate policy when an escalate outcome with then exists", () => {
       for (const form of ["HUMAN_INPUT_TIMEOUT_ESCALATE", "escalate"]) {
-        expect(() => loadWorkflowFromYaml(humanInputYamlWithOnTimeout(form)))
-          .toThrow(/timedApproval.*escalate.*not implemented/);
+        const model = loadWorkflowFromYaml(escalateYamlWithOutcomes(form, `
+          - name: proceed
+          - name: escalate
+            then: escalationPath
+        `));
+        const task = model.do[0].task;
+        expect(task.kind).toBe("human_input");
+        if (task.kind === "human_input") {
+          expect(task.humanInput.onTimeout).toBe("escalate");
+        }
       }
     });
 
+    it("call: human_input rejects the escalate policy without an escalate outcome", () => {
+      expect(() => loadWorkflowFromYaml(humanInputYamlWithOnTimeout("escalate")))
+        .toThrow(/timedApproval.*escalate.*requires an outcome named 'escalate'/);
+      expect(() => loadWorkflowFromYaml(escalateYamlWithOutcomes("HUMAN_INPUT_TIMEOUT_ESCALATE", `
+          - name: proceed
+          - name: reject
+      `)))
+        .toThrow(/timedApproval.*requires an outcome named 'escalate'/);
+    });
+
+    it("call: human_input rejects the escalate policy when the escalate outcome has no then", () => {
+      expect(() => loadWorkflowFromYaml(escalateYamlWithOutcomes("escalate", `
+          - name: proceed
+          - name: escalate
+      `)))
+        .toThrow(/timedApproval.*requires an outcome named 'escalate' with 'then' set/);
+    });
+
     it("call: human_input rejects unknown on_timeout values instead of silently failing at timeout", () => {
       expect(() => loadWorkflowFromYaml(humanInputYamlWithOnTimeout("sometimes")))
         .toThrow(/timedApproval.*unknown on_timeout value 'sometimes'.*fail, approve, deny/);

package/src/workflow-engine/__tests__/tasks/human-input.test.ts

@@ -305,6 +305,45 @@ describe("executeHumanInputTask", () => {
       expect(result).toEqual({ outcome: "reject", auto_resolved: true, reason: "timeout" });
     });
 
+    // The escalate outcome-by-name contract (stigmer/stigmer#781): the policy
+    // word IS the declared outcome's name, so no positional remapping happens
+    // — the ordinary name lookup finds the "escalate" outcome and routes its
+    // `then`, regardless of the outcome's position in the list.
+    it("resolves timeout escalate to the escalate-named outcome and routes its then", async () => {
+      const awaitFn: AwaitHumanInputFn = async () => ({
+        outcome: "escalate",
+        auto_resolved: true,
+        reason: "timeout",
+      });
+
+      const escalateOutcomes = [
+        { name: "proceed", label: "Proceed", then: "deployStep" },
+        { name: "escalate", label: "Escalate", then: "escalationPath" },
+        { name: "reject", label: "Reject" },
+      ];
+      const taskDef: HumanInputTaskDef = {
+        kind: "human_input",
+        humanInput: {
+          prompt: "Review", timeout: 5, onTimeout: "escalate", outcomes: escalateOutcomes,
+        },
+      };
+
+      const state = createState();
+      const result = await executeHumanInputTask(taskDef, "gate", state, makeCtx(awaitFn));
+
+      expect(result).toEqual({
+        outcome: "escalate",
+        auto_resolved: true,
+        reason: "timeout",
+        __flow_directive__: "escalationPath",
+      });
+      expect(state.data.gate).toEqual({
+        outcome: "escalate",
+        auto_resolved: true,
+        reason: "timeout",
+      });
+    });
+
     it("reports the mapped outcome on the approval_resolved event", async () => {
       const emitted: WorkflowEventDescriptor[][] = [];
       const emitFn: EmitEventsFn = async (events) => { emitted.push(events); };

package/src/workflow-engine/loader.ts

@@ -34,6 +34,7 @@ import type {
   BackoffConfig,
   JitterConfig,
   DurationDef,
+  HumanInputTimeoutPolicy,
 } from "./types.js";
 
 const SUPPORTED_DSL_RANGE = ">=1.0.0 <2.0.0";
@@ -548,12 +549,14 @@ function parseAgentCallRunConfig(raw: unknown): AgentCallConfig["run_config"] {
   }
   const obj = raw as Record<string, unknown>;
 
-  const known = new Set(["model_name", "max_cost_usd", "max_tool_rounds", "service_tier"]);
+  const known = new Set([
+    "model_name", "max_cost_usd", "max_tool_rounds", "service_tier", "thinking_mode",
+  ]);
   for (const key of Object.keys(obj)) {
     if (!known.has(key)) {
       throw new Error(
         `call:agent 'run_config' has unknown field '${key}' ` +
-        `(expected: model_name, max_cost_usd, max_tool_rounds, service_tier)`,
+        `(expected: model_name, max_cost_usd, max_tool_rounds, service_tier, thinking_mode)`,
       );
     }
   }
@@ -571,12 +574,14 @@ function parseAgentCallRunConfig(raw: unknown): AgentCallConfig["run_config"] {
     throw new Error("call:agent 'run_config.max_tool_rounds' must be a number >= 0");
   }
   const serviceTier = parseServiceTier(obj.service_tier);
+  const thinkingMode = parseThinkingMode(obj.thinking_mode);
 
   return {
     model_name: modelName,
     max_cost_usd: maxCostUsd,
     max_tool_rounds: maxToolRounds,
     service_tier: serviceTier,
+    thinking_mode: thinkingMode,
   };
 }
 
@@ -608,6 +613,34 @@ function parseServiceTier(raw: unknown): string | undefined {
   return canonical;
 }
 
+/**
+ * Maps YAML thinking-mode shorthands to canonical enum names, mirroring
+ * SERVICE_TIER_SHORTHANDS (stigmer/stigmer#772). Unknown values are
+ * authoring errors: the mode exists to make the served variant
+ * deterministic, so a typo must never silently fall back to the default.
+ */
+const THINKING_MODE_SHORTHANDS: Record<string, string> = {
+  disabled: "THINKING_MODE_DISABLED",
+  enabled: "THINKING_MODE_ENABLED",
+};
+
+function parseThinkingMode(raw: unknown): string | undefined {
+  if (raw === undefined || raw === null) return undefined;
+  if (typeof raw !== "string") {
+    throw new Error("call:agent 'run_config.thinking_mode' must be a string");
+  }
+  const canonical =
+    THINKING_MODE_SHORTHANDS[raw.toLowerCase()] ??
+    (Object.values(THINKING_MODE_SHORTHANDS).includes(raw) ? raw : undefined);
+  if (!canonical) {
+    throw new Error(
+      `call:agent 'run_config.thinking_mode' has unknown value '${raw}' ` +
+      `(expected: disabled, enabled)`,
+    );
+  }
+  return canonical;
+}
+
 /**
  * Maps on_timeout values to the runner's internal policy words, mirroring
  * SERVICE_TIER_SHORTHANDS. The persisted CNCF YAML carries the proto enum
@@ -618,36 +651,30 @@ function parseServiceTier(raw: unknown): string | undefined {
  * enum-name policy reach the orchestrator unrecognized, so gates configured
  * to auto-approve/deny failed at their first real timeout instead).
  */
-const ON_TIMEOUT_VOCABULARY: Record<string, "fail" | "approve" | "deny"> = {
+const ON_TIMEOUT_VOCABULARY: Record<string, HumanInputTimeoutPolicy> = {
   fail: "fail",
   approve: "approve",
   deny: "deny",
+  escalate: "escalate",
   HUMAN_INPUT_TIMEOUT_FAIL: "fail",
   HUMAN_INPUT_TIMEOUT_APPROVE: "approve",
   HUMAN_INPUT_TIMEOUT_DENY: "deny",
+  HUMAN_INPUT_TIMEOUT_ESCALATE: "escalate",
 };
 
 function parseOnTimeout(
   taskName: string,
   raw: unknown,
-): "fail" | "approve" | "deny" | undefined {
+): HumanInputTimeoutPolicy | undefined {
   if (raw === undefined || raw === null) return undefined;
   if (typeof raw !== "string") {
     throw new Error(`human_input task '${taskName}': 'on_timeout' must be a string`);
   }
-  // The proto declares HUMAN_INPUT_TIMEOUT_ESCALATE but no runtime exists
-  // for it yet; refuse at load rather than misbehave at the gate's timeout.
-  if (raw === "HUMAN_INPUT_TIMEOUT_ESCALATE" || raw === "escalate") {
-    throw new Error(
-      `human_input task '${taskName}': on_timeout policy 'escalate' is not implemented — ` +
-      `use fail, approve, or deny (custom outcomes with 'then' cover reviewer-driven branching)`,
-    );
-  }
   const policy = ON_TIMEOUT_VOCABULARY[raw];
   if (!policy) {
     throw new Error(
       `human_input task '${taskName}': unknown on_timeout value '${raw}' ` +
-      `(expected: fail, approve, deny, or a HUMAN_INPUT_TIMEOUT_* enum name)`,
+      `(expected: fail, approve, deny, escalate, or a HUMAN_INPUT_TIMEOUT_* enum name)`,
     );
   }
   return policy;
@@ -663,11 +690,30 @@ function parseHumanInputConfig(taskName: string, raw: unknown): import("./types.
     throw new Error(`human_input task '${taskName}' requires 'prompt' in 'with'`);
   }
 
+  const outcomes = Array.isArray(obj.outcomes) && obj.outcomes.length > 0
+    ? obj.outcomes.map((o: any) => ({ name: o.name, label: o.label, then: o.then }))
+    : undefined;
+  const onTimeout = parseOnTimeout(taskName, obj.on_timeout);
+
+  // The escalate policy's outcome-by-name contract (stigmer/stigmer#781):
+  // a timeout resolves to the outcome NAMED "escalate", so that outcome must
+  // exist and declare where the escalation branch goes. Checked at load so a
+  // misconfigured gate fails before it ever waits on a reviewer — the server
+  // validator enforces the same shape at apply; this covers hand-written YAML.
+  if (onTimeout === "escalate") {
+    const escalation = outcomes?.find((o) => o.name === "escalate");
+    if (!escalation || !escalation.then) {
+      throw new Error(
+        `human_input task '${taskName}': on_timeout policy 'escalate' requires ` +
+        `an outcome named 'escalate' with 'then' set (the timeout resolves to ` +
+        `that outcome and follows its 'then' branch)`,
+      );
+    }
+  }
+
   return {
     prompt: obj.prompt,
-    outcomes: Array.isArray(obj.outcomes) && obj.outcomes.length > 0
-      ? obj.outcomes.map((o: any) => ({ name: o.name, label: o.label, then: o.then }))
-      : undefined,
+    outcomes,
     formSchema: obj.form_schema && typeof obj.form_schema === "object"
       ? obj.form_schema as Record<string, unknown>
       : undefined,
@@ -675,7 +721,7 @@ function parseHumanInputConfig(taskName: string, raw: unknown): import("./types.
       ? obj.approvers.filter((a: unknown) => typeof a === "string") as string[]
       : undefined,
     timeout: typeof obj.timeout === "number" ? obj.timeout : undefined,
-    onTimeout: parseOnTimeout(taskName, obj.on_timeout),
+    onTimeout,
     // Any JSON shape is a valid payload (expression string, object, array),
     // so only null/undefined mean "no payload" here.
     payload: obj.payload ?? undefined,

package/src/workflow-engine/tasks/human-input.ts

@@ -2,7 +2,8 @@
  * Human input task executor — HITL approval gate.
  *
  * Pauses workflow execution until a human reviewer responds via signal.
- * Supports configurable timeout with policies (fail, auto-approve, auto-deny).
+ * Supports configurable timeout with policies (fail, auto-approve,
+ * auto-deny, escalate).
  *
  * The kernel validates the config and delegates to `ctx.awaitHumanInput()`
  * which is wired to the Temporal workflow layer's signal/timer selector.
@@ -143,6 +144,12 @@ function validateConfig(config: HumanInputConfig, taskName: string): void {
  * orchestrator's internal approve/deny words, which a reviewer of a
  * custom-outcome gate was never offered. Binary gates (no custom outcomes)
  * keep the plain approve/deny result.
+ *
+ * Escalate needs no remapping by construction (stigmer/stigmer#781): its
+ * policy word IS the declared outcome's name — the loader (and the server
+ * validator) only accept the escalate policy when an outcome named
+ * "escalate" with `then` exists, so the caller's ordinary name lookup
+ * routes the escalation branch.
  */
 function applyTimeoutOutcomeContract(
   result: HumanInputResult,

package/src/workflow-engine/types.ts

@@ -557,14 +557,23 @@ export interface RunWorkflowExecutionConfig {
 
 /**
  * Blocks workflow execution until a human provides input via signal.
- * Supports configurable timeout with policies (fail, approve, deny).
+ * Supports configurable timeout with policies (fail, approve, deny, escalate).
  */
 export type AwaitHumanInputFn = (config: HumanInputExecutionConfig) => Promise<HumanInputResult>;
 
+/**
+ * Internal timeout-policy vocabulary — the loader-normalized form of the
+ * proto's HumanInputTimeoutPolicy enum. "escalate" carries the outcome-by-name
+ * contract (stigmer/stigmer#781): it is only loadable when the gate declares
+ * an outcome named "escalate" with `then` set, and a timeout resolves to that
+ * outcome so the existing `then`/flow-directive routing takes the branch.
+ */
+export type HumanInputTimeoutPolicy = "fail" | "approve" | "deny" | "escalate";
+
 export interface HumanInputExecutionConfig {
   readonly signalName: string;
   readonly timeoutSeconds: number;
-  readonly onTimeout: "fail" | "approve" | "deny";
+  readonly onTimeout: HumanInputTimeoutPolicy;
 }
 
 export interface HumanInputResult {
@@ -602,7 +611,7 @@ export interface HumanInputConfig {
   readonly formSchema?: Record<string, unknown>;
   readonly approvers?: readonly string[];
   readonly timeout?: number;
-  readonly onTimeout?: "fail" | "approve" | "deny";
+  readonly onTimeout?: HumanInputTimeoutPolicy;
   /**
    * Material for the reviewer to examine — a whole-value expression
    * string, or an object/array with embedded expressions. Resolved at
@@ -749,6 +758,12 @@ export interface AgentCallRunConfig {
    * ("standard"/"fast") to these, mirroring harness.
    */
   readonly service_tier?: string;
+  /**
+   * Canonical ThinkingMode enum name ("THINKING_MODE_DISABLED" /
+   * "THINKING_MODE_ENABLED"); the loader maps the YAML shorthands
+   * ("disabled"/"enabled") to these, mirroring service_tier (#772).
+   */
+  readonly thinking_mode?: string;
 }
 
 export interface AgentCallOutputContract {

package/src/workflows/human-input-orchestrator.ts

@@ -7,6 +7,10 @@
  * - "fail": throws an error
  * - "approve": returns auto-approved output
  * - "deny": returns auto-denied output
+ * - "escalate": returns the "escalate" outcome — by the outcome-by-name
+ *   contract (stigmer/stigmer#781) the loader guarantees the gate declares
+ *   an outcome with that exact name and a `then` branch, so the executor's
+ *   ordinary outcome routing takes the escalation path.
  *
  * Signal payload shape:
  * { outcome, form_data?, reviewer, reviewer_actor?, responded_at }
@@ -16,7 +20,11 @@
 
 import { defineSignal, setHandler, condition } from "@temporalio/workflow";
 
-import type { HumanInputExecutionConfig, HumanInputResult } from "../workflow-engine/types.js";
+import type {
+  HumanInputExecutionConfig,
+  HumanInputResult,
+  HumanInputTimeoutPolicy,
+} from "../workflow-engine/types.js";
 
 /**
  * Orchestrates a human_input task — blocks until signal or timeout.
@@ -51,7 +59,7 @@ export async function orchestrateHumanInput(
 
 function handleTimeout(
   signalName: string,
-  policy: "fail" | "approve" | "deny",
+  policy: HumanInputTimeoutPolicy,
 ): HumanInputResult {
   switch (policy) {
     case "approve":
@@ -68,6 +76,16 @@ function handleTimeout(
         reason: "timeout",
       };
 
+    case "escalate":
+      // The outcome word IS the declared outcome's name (loader-enforced),
+      // so no positional remapping happens downstream — the executor's name
+      // lookup routes the escalation branch directly.
+      return {
+        outcome: "escalate",
+        auto_resolved: true,
+        reason: "timeout",
+      };
+
     case "fail":
     default:
       throw new Error(