@stigmer/runner 3.34.0 → 3.35.0

package/dist/.build-fingerprint

@@ -1 +1 @@
-{"hash":"cd5b1f400f84c402","builtAt":"2026-09-28T08:41:09.916Z","fileCount":334}
+{"hash":"380a77662a3e06cc","builtAt":"2026-09-28T10:39:48.086Z","fileCount":334}

package/dist/tools/url-guard.js

@@ -88,6 +88,9 @@ export async function validateFetchUrl(rawUrl, posture) {
             // The check itself never follows a redirect; web_fetch walks hops
             // one validateFetchUrl at a time, so this refusal cannot arise here.
             throw new UrlGuardError(`Refusing to follow more than ${refusal.hops} redirects.`);
+        case "response-too-large":
+            // Only the guarded fetch reads a body; the check never does.
+            throw new UrlGuardError(`Refusing to read more than ${refusal.maxBytes} bytes.`);
         default: {
             const exhaustive = refusal;
             throw new UrlGuardError(String(exhaustive));

package/dist/tools/url-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"url-guard.js","sourceRoot":"","sources":["../../src/tools/url-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,UAAU,EACV,aAAa,IAAI,mBAAmB,GAErC,MAAM,0BAA0B,CAAC;AAIlC,iFAAiF;AACjF,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAuB,EACvB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,GAAG,CAAC,+BAA+B,CAAC;IACrD,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC1C,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAE5B;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,OAAqB;IAErB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACrF,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC;IAE/B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,aAAa;YAChB,MAAM,IAAI,aAAa,CAAC,gBAAgB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,KAAK,oBAAoB;YACvB,MAAM,IAAI,aAAa,CACrB,2BAA2B,OAAO,CAAC,MAAM,sCAAsC,CAChF,CAAC;QACJ,KAAK,cAAc;YACjB,MAAM,IAAI,aAAa,CAAC,+BAA+B,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7E,KAAK,SAAS;YACZ,MAAM,IAAI,aAAa,CACrB,qBAAqB,OAAO,CAAC,QAAQ,oBAAoB,OAAO,CAAC,OAAO,OAAO,OAAO,CAAC,MAAM,gDAAgD,CAC9I,CAAC;QACJ,KAAK,oBAAoB;YACvB,kEAAkE;YAClE,qEAAqE;YACrE,MAAM,IAAI,aAAa,CAAC,gCAAgC,OAAO,CAAC,IAAI,aAAa,CAAC,CAAC;QACrF,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAqB;IAClE,OAAO,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"url-guard.js","sourceRoot":"","sources":["../../src/tools/url-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,UAAU,EACV,aAAa,IAAI,mBAAmB,GAErC,MAAM,0BAA0B,CAAC;AAIlC,iFAAiF;AACjF,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAuB,EACvB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,GAAG,CAAC,+BAA+B,CAAC;IACrD,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC1C,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;AAE5B;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,OAAqB;IAErB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,sBAAsB,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACrF,IAAI,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC;IAE/B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,aAAa;YAChB,MAAM,IAAI,aAAa,CAAC,gBAAgB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,KAAK,oBAAoB;YACvB,MAAM,IAAI,aAAa,CACrB,2BAA2B,OAAO,CAAC,MAAM,sCAAsC,CAChF,CAAC;QACJ,KAAK,cAAc;YACjB,MAAM,IAAI,aAAa,CAAC,+BAA+B,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7E,KAAK,SAAS;YACZ,MAAM,IAAI,aAAa,CACrB,qBAAqB,OAAO,CAAC,QAAQ,oBAAoB,OAAO,CAAC,OAAO,OAAO,OAAO,CAAC,MAAM,gDAAgD,CAC9I,CAAC;QACJ,KAAK,oBAAoB;YACvB,kEAAkE;YAClE,qEAAqE;YACrE,MAAM,IAAI,aAAa,CAAC,gCAAgC,OAAO,CAAC,IAAI,aAAa,CAAC,CAAC;QACrF,KAAK,oBAAoB;YACvB,6DAA6D;YAC7D,MAAM,IAAI,aAAa,CAAC,8BAA8B,OAAO,CAAC,QAAQ,SAAS,CAAC,CAAC;QACnF,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,OAAqB;IAClE,OAAO,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC/C,CAAC"}

package/dist/workflow-engine/types.d.ts

@@ -270,10 +270,15 @@ export interface ScriptRunConfig {
     readonly arguments?: Record<string, unknown>;
     readonly environment?: Record<string, string>;
 }
+/**
+ * The Serverless Workflow child reference. The server's converter emits
+ * `name` and, when set, `input`; RunTaskConfig carries no namespace or
+ * version, so both are optional here and nothing reads them.
+ */
 export interface WorkflowRunConfig {
-    readonly namespace: string;
+    readonly namespace?: string;
     readonly name: string;
-    readonly version: string;
+    readonly version?: string;
     readonly input?: unknown;
 }
 /**

package/dist/workflow-engine/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/workflow-engine/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA6LH,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AACxC,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,CAAC;AAC9B,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC;AAEhC,MAAM,UAAU,aAAa,CAAC,SAAwB;IACpD,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,SAAS,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAwB;IACvD,OAAO,CACL,SAAS,KAAK,aAAa;QAC3B,SAAS,KAAK,QAAQ;QACtB,SAAS,KAAK,SAAS,CACxB,CAAC;AACJ,CAAC;AAkwBD,wEAAwE;AACxE,cAAc;AACd,wEAAwE;AAExE;;;;;;;;;;GAUG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,gBAAgB,CAAS;IAElC,YAAY,OAAe,EAAE,gBAAwB;QACnD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;CACF"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/workflow-engine/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA6LH,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AACxC,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,CAAC;AAC9B,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC;AAEhC,MAAM,UAAU,aAAa,CAAC,SAAwB;IACpD,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,SAAS,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAwB;IACvD,OAAO,CACL,SAAS,KAAK,aAAa;QAC3B,SAAS,KAAK,QAAQ;QACtB,SAAS,KAAK,SAAS,CACxB,CAAC;AACJ,CAAC;AAuwBD,wEAAwE;AACxE,cAAc;AACd,wEAAwE;AAExE;;;;;;;;;;GAUG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,gBAAgB,CAAS;IAElC,YAAY,OAAe,EAAE,gBAAwB;QACnD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/runner",
-  "version": "3.34.0",
+  "version": "3.35.0",
   "description": "Embeddable Temporal worker for the Stigmer AI agent platform — handles agent execution, workflow orchestration, and MCP server management",
   "license": "Apache-2.0",
   "type": "module",
@@ -108,10 +108,10 @@
     "@opentelemetry/sdk-metrics": "^2.0.0",
     "@opentelemetry/sdk-trace-base": "^2.0.0",
     "@opentelemetry/sdk-trace-node": "^2.0.0",
-    "@stigmer/outbound": "3.34.0",
-    "@stigmer/protos": "3.34.0",
-    "@stigmer/temporal-codecs": "3.34.0",
-    "@stigmer/zip-structure": "3.34.0",
+    "@stigmer/outbound": "3.35.0",
+    "@stigmer/protos": "3.35.0",
+    "@stigmer/temporal-codecs": "3.35.0",
+    "@stigmer/zip-structure": "3.35.0",
     "@temporalio/activity": "1.16.2",
     "@temporalio/common": "1.16.2",
     "@temporalio/interceptors-opentelemetry": "1.16.2",

package/src/tools/url-guard.ts

@@ -108,6 +108,9 @@ export async function validateFetchUrl(
       // The check itself never follows a redirect; web_fetch walks hops
       // one validateFetchUrl at a time, so this refusal cannot arise here.
       throw new UrlGuardError(`Refusing to follow more than ${refusal.hops} redirects.`);
+    case "response-too-large":
+      // Only the guarded fetch reads a body; the check never does.
+      throw new UrlGuardError(`Refusing to read more than ${refusal.maxBytes} bytes.`);
     default: {
       const exhaustive: never = refusal;
       throw new UrlGuardError(String(exhaustive));

package/src/workflow-engine/types.ts

@@ -377,10 +377,15 @@ export interface ScriptRunConfig {
   readonly environment?: Record<string, string>;
 }
 
+/**
+ * The Serverless Workflow child reference. The server's converter emits
+ * `name` and, when set, `input`; RunTaskConfig carries no namespace or
+ * version, so both are optional here and nothing reads them.
+ */
 export interface WorkflowRunConfig {
-  readonly namespace: string;
+  readonly namespace?: string;
   readonly name: string;
-  readonly version: string;
+  readonly version?: string;
   readonly input?: unknown;
 }