@stigmer/runner 3.15.3-dev.20260916211208 → 3.16.1-dev.20260917224426

package/src/workflows/__tests__/run-credential-interceptor.test.ts

@@ -0,0 +1,178 @@
+/**
+ * The workflow side of the run credential (`interceptors/run-credential.ts`):
+ * the stamp on both activity kinds, the gate by workflow type, the
+ * credential-less pass-through, and the fence that every gated type is a
+ * real export alias of the workflow barrel.
+ *
+ * `workflowInfo()` is the only sandbox API the interceptor reads; it is
+ * replaced here so the factory can run outside an isolate. Everything else
+ * from `@temporalio/workflow` is the real module, imported once for the
+ * barrel fence.
+ */
+
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { defaultPayloadConverter } from "@temporalio/common";
+import type {
+  ActivityInput,
+  LocalActivityInput,
+  WorkflowExecuteInput,
+} from "@temporalio/workflow";
+
+let workflowType = "";
+
+vi.mock("@temporalio/workflow", async (importOriginal) => {
+  const original =
+    await importOriginal<typeof import("@temporalio/workflow")>();
+  return { ...original, workflowInfo: () => ({ workflowType }) };
+});
+
+import {
+  RUN_WORKFLOW_TYPES,
+  interceptors,
+} from "../interceptors/run-credential.js";
+import { EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE } from "../execute-from-execution.js";
+import {
+  RUN_CREDENTIAL_HEADER,
+  RUN_CREDENTIAL_INPUT_KEY,
+} from "../../shared/run-credential.js";
+import * as barrel from "../index.js";
+
+/** Drive one workflow run through the factory: its inbound execute, then one schedule of each kind. */
+async function run(type: string, workflowArg: unknown) {
+  workflowType = type;
+  const { inbound, outbound } = interceptors();
+  const executeInput: WorkflowExecuteInput = {
+    args: [workflowArg],
+    headers: {},
+  };
+  await inbound![0]!.execute!(executeInput, async () => undefined);
+
+  const seen: { activity?: ActivityInput; local?: LocalActivityInput } = {};
+  const activityInput = {
+    activityType: "EmitWorkflowEvents",
+    args: ["wex_1"],
+    headers: {},
+    options: {},
+    seq: 1,
+  } as unknown as ActivityInput;
+  const localInput = {
+    activityType: "PromoteTaskOutput",
+    args: ["out", "wex_1"],
+    headers: {},
+    options: {},
+    seq: 2,
+  } as unknown as LocalActivityInput;
+  await outbound![0]!.scheduleActivity!(activityInput, async (input) => {
+    seen.activity = input;
+    return undefined;
+  });
+  await outbound![0]!.scheduleLocalActivity!(localInput, async (input) => {
+    seen.local = input;
+    return undefined;
+  });
+  return seen;
+}
+
+function credentialIn(headers: ActivityInput["headers"] | undefined): unknown {
+  const payload = headers?.[RUN_CREDENTIAL_HEADER];
+  return payload === undefined
+    ? undefined
+    : defaultPayloadConverter.fromPayload(payload);
+}
+
+describe("run-credential workflow interceptors", () => {
+  beforeEach(() => {
+    workflowType = "";
+  });
+
+  it("stamps the run workflow's credential onto a remote activity and a local activity alike", async () => {
+    const seen = await run(EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE, {
+      execution_id: "wex_1",
+      [RUN_CREDENTIAL_INPUT_KEY]: "cred-run",
+    });
+    expect(credentialIn(seen.activity?.headers)).toBe("cred-run");
+    expect(credentialIn(seen.local?.headers)).toBe("cred-run");
+  });
+
+  it("keeps the other headers a schedule already carries", async () => {
+    workflowType = EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE;
+    const { inbound, outbound } = interceptors();
+    await inbound![0]!.execute!(
+      { args: [{ [RUN_CREDENTIAL_INPUT_KEY]: "cred-run" }], headers: {} },
+      async () => undefined,
+    );
+    const other = defaultPayloadConverter.toPayload("trace");
+    let stamped: ActivityInput | undefined;
+    await outbound![0]!.scheduleActivity!(
+      {
+        activityType: "X",
+        args: [],
+        headers: { "_tracer-data": other },
+        options: {},
+        seq: 1,
+      } as unknown as ActivityInput,
+      async (input) => {
+        stamped = input;
+        return undefined;
+      },
+    );
+    expect(stamped?.headers["_tracer-data"]).toBe(other);
+    expect(credentialIn(stamped?.headers)).toBe("cred-run");
+  });
+
+  it("stamps nothing when the run workflow's input carries no credential — an older server's dispatch replays byte for byte", async () => {
+    const seen = await run(EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE, {
+      execution_id: "wex_1",
+    });
+    expect(seen.activity?.headers).toEqual({});
+    expect(seen.local?.headers).toEqual({});
+  });
+
+  it("stamps nothing for the connect workflow even though its input carries the same key — that token is not a run credential", async () => {
+    const seen = await run("stigmer/mcp-server/connect", {
+      mcp_server_id: "mcp_1",
+      [RUN_CREDENTIAL_INPUT_KEY]: "connect-token",
+    });
+    expect(seen.activity?.headers).toEqual({});
+    expect(seen.local?.headers).toEqual({});
+  });
+
+  it("keeps each workflow run's credential on its own factory instance", async () => {
+    workflowType = EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE;
+    const first = interceptors();
+    const second = interceptors();
+    await first.inbound![0]!.execute!(
+      { args: [{ [RUN_CREDENTIAL_INPUT_KEY]: "cred-1" }], headers: {} },
+      async () => undefined,
+    );
+    await second.inbound![0]!.execute!(
+      { args: [{ execution_id: "wex_2" }], headers: {} },
+      async () => undefined,
+    );
+    let fromSecond: ActivityInput | undefined;
+    await second.outbound![0]!.scheduleActivity!(
+      {
+        activityType: "X",
+        args: [],
+        headers: {},
+        options: {},
+        seq: 1,
+      } as unknown as ActivityInput,
+      async (input) => {
+        fromSecond = input;
+        return undefined;
+      },
+    );
+    expect(fromSecond?.headers).toEqual({});
+  });
+
+  it("gates on workflow types that are export aliases of the barrel — the list cannot name a type that does not exist", () => {
+    expect(RUN_WORKFLOW_TYPES).toEqual([EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE]);
+    for (const type of RUN_WORKFLOW_TYPES) {
+      expect(
+        Object.keys(barrel),
+        `"${type}" must be exported by workflows/index.ts`,
+      ).toContain(type);
+    }
+  });
+});

package/src/workflows/execute-from-execution.ts

@@ -47,6 +47,16 @@ const hydrateProxy = proxyActivities<HydrateActivities>({
 // Workflow Input Type (Temporal wire contract with Java/Go orchestrators)
 // ─────────────────────────────────────────────────────────────────────────────
 
+/**
+ * The Temporal workflow type this function is exported as in `index.ts` — the
+ * server's `CHILD_WORKFLOW_TYPE`, byte-pinned on both sides. Named here so
+ * the run-credential interceptor can gate on it without a second literal; a
+ * test pins it to the barrel's export alias (an ES2022 export alias must be a
+ * literal, so the barrel cannot import this).
+ */
+export const EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE =
+  "stigmer/workflow/execute-from-execution";
+
 export interface ExecuteFromExecutionInput {
   execution_id: string;
   workflow_instance_id: string;
@@ -55,6 +65,13 @@ export interface ExecuteFromExecutionInput {
   callback_token?: Uint8Array | null;
   invoker_identity_account_id?: string;
   recovery_mode?: boolean;
+  /**
+   * The run credential the server minted for this execution at dispatch —
+   * absent from an older server's dispatch. This workflow never reads it: the
+   * interceptor in `interceptors/run-credential.ts` lifts it onto every
+   * activity this workflow schedules, as a header (`shared/run-credential.ts`).
+   */
+  execution_context_token?: string;
 }
 
 // ─────────────────────────────────────────────────────────────────────────────

package/src/workflows/index.ts

@@ -13,9 +13,11 @@
  * us map TypeScript function names to the slash-delimited Temporal
  * workflow type names that the backend expects.
  *
- * OTel workflow interceptors are registered at bundle time — not
- * imported here. Pre-built bundles (scripts/bundle-slim.mjs) bake them
- * in; the runtime-bundling fallback passes them to the bundler (see
+ * Workflow interceptors are registered at bundle time — not imported
+ * here: the runner's own run-credential interceptor
+ * (./interceptors/run-credential.ts, always) and OTel's (when the host
+ * configures the sink). Pre-built bundles (scripts/bundle-slim.mjs) bake
+ * them in; the runtime-bundling fallback passes them to the bundler (see
  * src/workflow-source.ts).
  */
 

package/src/workflows/interceptors/run-credential.ts

@@ -0,0 +1,101 @@
+/**
+ * Workflow-side interceptors that carry a run's credential from the workflow
+ * input to every activity the workflow schedules — as a Temporal activity
+ * header, the SDK's channel for context that crosses the isolate boundary
+ * without being anybody's argument (`shared/run-credential.ts` has the
+ * whole story; `interceptors/run-credential-activity.ts` is the other end).
+ *
+ * Gated by WORKFLOW TYPE, not by input shape. The connect workflow's input
+ * carries the same key for a different token — a clocked decrypt-lane token
+ * bound to a synthetic id that no verifier admits as a run — and stamping it
+ * onto that lane's activities would present it where it does not belong.
+ * The gate is the positive list below: the workflow types whose input
+ * carries a RUN credential. One entry today; a test pins each entry to an
+ * export of `workflows/index.ts`, so the list cannot name a type that does
+ * not exist.
+ *
+ * Per-run state lives on this factory's closure: the SDK instantiates the
+ * factory once per workflow run, which is the documented contract. The
+ * header is a pure function of the input, so replay recomputes exactly what
+ * was recorded, and a credential-less input stamps nothing — an in-flight
+ * run from before the credential existed replays byte for byte.
+ *
+ * TEMPORAL SANDBOX: this file is bundled into the workflow isolate. No Node
+ * built-ins. It is baked into the pre-built bundle by
+ * `scripts/bundle-slim.mjs` and passed to the runtime bundler by both worker
+ * roots (`src/workflow-source.ts` names it beside the OTel module).
+ */
+
+import { workflowInfo } from "@temporalio/workflow";
+import type {
+  ActivityInput,
+  LocalActivityInput,
+  Next,
+  WorkflowExecuteInput,
+  WorkflowInboundCallsInterceptor,
+  WorkflowInterceptorsFactory,
+  WorkflowOutboundCallsInterceptor,
+} from "@temporalio/workflow";
+import { defaultPayloadConverter } from "@temporalio/common";
+
+import {
+  RUN_CREDENTIAL_HEADER,
+  readRunCredentialFromInput,
+} from "../../shared/run-credential.js";
+import { EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE } from "../execute-from-execution.js";
+
+/**
+ * The workflow types whose input carries a run credential. Byte-pinned wire
+ * names; each must be an export alias of `workflows/index.ts`.
+ */
+export const RUN_WORKFLOW_TYPES: readonly string[] = [
+  EXECUTE_FROM_EXECUTION_WORKFLOW_TYPE,
+];
+
+export const interceptors: WorkflowInterceptorsFactory = () => {
+  let credential: string | undefined;
+
+  const inbound: WorkflowInboundCallsInterceptor = {
+    async execute(
+      input: WorkflowExecuteInput,
+      next: Next<WorkflowInboundCallsInterceptor, "execute">,
+    ) {
+      if (RUN_WORKFLOW_TYPES.includes(workflowInfo().workflowType)) {
+        credential = readRunCredentialFromInput(input.args[0]);
+      }
+      return next(input);
+    },
+  };
+
+  const outbound: WorkflowOutboundCallsInterceptor = {
+    async scheduleActivity(
+      input: ActivityInput,
+      next: Next<WorkflowOutboundCallsInterceptor, "scheduleActivity">,
+    ) {
+      return next(stamped(input));
+    },
+    async scheduleLocalActivity(
+      input: LocalActivityInput,
+      next: Next<WorkflowOutboundCallsInterceptor, "scheduleLocalActivity">,
+    ) {
+      return next(stamped(input));
+    },
+  };
+
+  function stamped<T extends { readonly headers: ActivityInput["headers"] }>(
+    input: T,
+  ): T {
+    if (credential === undefined) {
+      return input;
+    }
+    return {
+      ...input,
+      headers: {
+        ...input.headers,
+        [RUN_CREDENTIAL_HEADER]: defaultPayloadConverter.toPayload(credential),
+      },
+    };
+  }
+
+  return { inbound: [inbound], outbound: [outbound] };
+};