@stigmer/runner 3.6.0 → 3.8.0

package/src/workflow-engine/__tests__/loader.test.ts

@@ -420,12 +420,13 @@ do:
       with:
         agent: "acme/support-triage"
         message: "Triage this ticket"
-        org: acme
         env:
           API_KEY: "\${.secrets.KEY}"
-        config:
-          model: claude-3-5-sonnet
-          timeout: 300
+        run_config:
+          model_name: claude-3-5-sonnet
+          max_cost_usd: 0.5
+          max_tool_rounds: 15
+          service_tier: fast
         output:
           schema:
             type: object
@@ -444,10 +445,11 @@ do:
       if (task.kind === "call:agent") {
         expect(task.with.agent).toBe("acme/support-triage");
         expect(task.with.message).toBe("Triage this ticket");
-        expect(task.with.org).toBe("acme");
         expect(task.with.env?.API_KEY).toBe("${.secrets.KEY}");
-        expect(task.with.config?.model).toBe("claude-3-5-sonnet");
-        expect(task.with.config?.timeout).toBe(300);
+        expect(task.with.run_config?.model_name).toBe("claude-3-5-sonnet");
+        expect(task.with.run_config?.max_cost_usd).toBe(0.5);
+        expect(task.with.run_config?.max_tool_rounds).toBe(15);
+        expect(task.with.run_config?.service_tier).toBe("SERVICE_TIER_FAST");
         expect(task.with.output?.schema.type).toBe("object");
         expect(task.with.output?.on_invalid).toBe("ON_INVALID_RETRY");
         expect(task.with.output?.max_retries).toBe(2);
@@ -455,6 +457,189 @@ do:
       }
     });
 
+    it("rejects unknown run_config keys with a named error", () => {
+      const yaml = `
+document:
+  dsl: '1.0.0'
+  name: test
+do:
+  - invoke:
+      call: agent
+      with:
+        agent: reviewer
+        message: Review
+        run_config:
+          model: claude-sonnet-4-6
+`;
+      // "model" is the pre-#358 key; the shared RunConfig field is
+      // "model_name". A typo'd knob must fail parsing, not silently no-op.
+      expect(() => loadWorkflowFromYaml(yaml)).toThrow(
+        "call:agent 'run_config' has unknown field 'model'",
+      );
+    });
+
+    it("maps service_tier shorthands and canonical names to the enum name", () => {
+      for (const [written, expected] of [
+        ["standard", "SERVICE_TIER_STANDARD"],
+        ["fast", "SERVICE_TIER_FAST"],
+        ["FAST", "SERVICE_TIER_FAST"],
+        ["SERVICE_TIER_STANDARD", "SERVICE_TIER_STANDARD"],
+      ] as const) {
+        const yaml = `
+document:
+  dsl: '1.0.0'
+  name: test
+do:
+  - invoke:
+      call: agent
+      with:
+        agent: reviewer
+        message: Review
+        run_config:
+          service_tier: "${written}"
+`;
+        const model = loadWorkflowFromYaml(yaml);
+        const task = model.do[0].task;
+        if (task.kind === "call:agent") {
+          expect(task.with.run_config?.service_tier).toBe(expected);
+        } else {
+          throw new Error("expected call:agent task");
+        }
+      }
+    });
+
+    it("rejects an unknown service_tier value with a named error", () => {
+      const yaml = `
+document:
+  dsl: '1.0.0'
+  name: test
+do:
+  - invoke:
+      call: agent
+      with:
+        agent: reviewer
+        message: Review
+        run_config:
+          service_tier: turbo
+`;
+      // The tier exists to make pricing deterministic — a typo must fail
+      // parsing, never silently fall back to the default tier.
+      expect(() => loadWorkflowFromYaml(yaml)).toThrow(
+        "call:agent 'run_config.service_tier' has unknown value 'turbo'",
+      );
+    });
+
+    it("rejects negative run_config bounds", () => {
+      const yaml = `
+document:
+  dsl: '1.0.0'
+  name: test
+do:
+  - invoke:
+      call: agent
+      with:
+        agent: reviewer
+        message: Review
+        run_config:
+          max_cost_usd: -1
+`;
+      expect(() => loadWorkflowFromYaml(yaml)).toThrow(
+        "call:agent 'run_config.max_cost_usd' must be a number >= 0",
+      );
+    });
+
+    it("parses git workspace entries", () => {
+      const yaml = `
+document:
+  dsl: '1.0.0'
+  name: test
+do:
+  - invoke:
+      call: agent
+      with:
+        agent: reviewer
+        message: Review
+        workspace_entries:
+          - name: app
+            source:
+              git_repo:
+                url: https://github.com/acme/app
+                branch: main
+          - source:
+              git_repo:
+                url: https://github.com/acme/lib
+`;
+      const model = loadWorkflowFromYaml(yaml);
+      const task = model.do[0].task;
+      expect(task.kind).toBe("call:agent");
+      if (task.kind === "call:agent") {
+        const entries = task.with.workspace_entries;
+        expect(entries).toHaveLength(2);
+        expect(entries?.[0].name).toBe("app");
+        expect(entries?.[0].source.git_repo.url).toBe("https://github.com/acme/app");
+        expect(entries?.[0].source.git_repo.branch).toBe("main");
+        expect(entries?.[1].name).toBeUndefined();
+        expect(entries?.[1].source.git_repo.branch).toBeUndefined();
+      }
+    });
+
+    it("rejects a workspace entry without a git url", () => {
+      const yaml = `
+document:
+  dsl: '1.0.0'
+  name: test
+do:
+  - invoke:
+      call: agent
+      with:
+        agent: reviewer
+        message: Review
+        workspace_entries:
+          - source:
+              local_path:
+                path: /home/me/repo
+`;
+      expect(() => loadWorkflowFromYaml(yaml)).toThrow(
+        "call:agent 'workspace_entries[0]' requires 'source.git_repo.url'",
+      );
+    });
+
+    it("rejects a non-list workspace_entries", () => {
+      const yaml = `
+document:
+  dsl: '1.0.0'
+  name: test
+do:
+  - invoke:
+      call: agent
+      with:
+        agent: reviewer
+        message: Review
+        workspace_entries: "https://github.com/acme/app"
+`;
+      expect(() => loadWorkflowFromYaml(yaml)).toThrow(
+        "call:agent 'workspace_entries' must be a list",
+      );
+    });
+
+    it("rejects a non-mapping run_config", () => {
+      const yaml = `
+document:
+  dsl: '1.0.0'
+  name: test
+do:
+  - invoke:
+      call: agent
+      with:
+        agent: reviewer
+        message: Review
+        run_config: "cheap"
+`;
+      expect(() => loadWorkflowFromYaml(yaml)).toThrow(
+        "call:agent 'run_config' must be a mapping",
+      );
+    });
+
     it("normalizes harness shorthand 'native' to HARNESS_NATIVE", () => {
       const yaml = `
 document:

package/src/workflow-engine/__tests__/tasks/call-agent.test.ts

@@ -108,16 +108,15 @@ describe("CallAgentTaskBuilder", () => {
     expect(config.env.GITHUB_TOKEN).toBe("${.secrets.GH_TOKEN}");
   });
 
-  it("passes org from config when specified", async () => {
+  it("passes org-prefixed agent references through untouched", async () => {
     mockCallAgent.mockResolvedValue({ final_text: "done" });
 
     const taskDef: CallAgentTaskDef = {
       kind: "call:agent",
       call: "agent",
       with: {
-        agent: "my-agent",
+        agent: "acme/my-agent",
         message: "Hello",
-        org: "acme",
       },
     };
 
@@ -127,7 +126,7 @@ describe("CallAgentTaskBuilder", () => {
     await executor({}, createState(), makeCtx());
 
     const [config] = mockCallAgent.mock.calls[0];
-    expect(config.org).toBe("acme");
+    expect(config.agent).toBe("acme/my-agent");
   });
 
   it("shouldRun returns true", async () => {
@@ -495,7 +494,7 @@ describe("CallAgentTaskBuilder — output.schema propagation", () => {
         agent: "notification-analyst",
         message: "Generate the daily cohort analysis report.",
         output: { schema: cohortSchema, on_invalid: "ON_INVALID_FAIL" },
-        config: { model: "claude-sonnet-4", timeout: 300 },
+        run_config: { model_name: "claude-sonnet-4" },
         harness: "HARNESS_CURSOR",
       },
     };
@@ -525,7 +524,7 @@ describe("CallAgentTaskBuilder — output.schema propagation", () => {
           "Date: ${ $env.NOTIFICATION_DATE }\n" +
           "Data source: decor schema.",
         output: { schema: cohortSchema, on_invalid: "ON_INVALID_FAIL" },
-        config: { model: "claude-sonnet-4" },
+        run_config: { model_name: "claude-sonnet-4" },
       },
     };
 
@@ -596,7 +595,7 @@ describe("CallAgentTaskBuilder — output.schema propagation", () => {
     expect(config.output.schema.required).toEqual(["executive_summary", "cohorts", "anomalies"]);
   });
 
-  it("preserves output.schema alongside config, harness, and env fields", async () => {
+  it("preserves output.schema alongside run_config, harness, and env fields", async () => {
     mockCallAgent.mockResolvedValue({ structured: { executive_summary: "ok", cohorts: [], anomalies: [] } });
 
     const taskDef: CallAgentTaskDef = {
@@ -606,7 +605,7 @@ describe("CallAgentTaskBuilder — output.schema propagation", () => {
         agent: "notification-analyst",
         message: "Analyze data.",
         env: { POSTGRES_CONNECTION_URL: "${.secrets.PG_URL}" },
-        config: { model: "claude-sonnet-4", timeout: 300 },
+        run_config: { model_name: "claude-sonnet-4", max_cost_usd: 0.5 },
         output: { schema: cohortSchema, on_invalid: "ON_INVALID_FAIL" },
         harness: "HARNESS_CURSOR",
       },
@@ -618,7 +617,8 @@ describe("CallAgentTaskBuilder — output.schema propagation", () => {
 
     const [config] = mockCallAgent.mock.calls[0];
     expect(config.agent).toBe("notification-analyst");
-    expect(config.config?.model).toBe("claude-sonnet-4");
+    expect(config.run_config?.model_name).toBe("claude-sonnet-4");
+    expect(config.run_config?.max_cost_usd).toBe(0.5);
     expect(config.env?.POSTGRES_CONNECTION_URL).toBe("${.secrets.PG_URL}");
     expect(config.harness).toBe("HARNESS_CURSOR");
     expect(config.output).toBeDefined();

package/src/workflow-engine/loader.ts

@@ -489,14 +489,125 @@ function parseAgentCallConfig(raw: unknown): AgentCallConfig {
   return {
     agent: obj.agent,
     message: obj.message,
-    org: typeof obj.org === "string" ? obj.org : undefined,
     env: obj.env as Record<string, string> | undefined,
-    config: obj.config as AgentCallConfig["config"],
+    run_config: parseAgentCallRunConfig(obj.run_config),
     output: obj.output as AgentCallConfig["output"],
     harness,
+    workspace_entries: parseAgentCallWorkspaceEntries(obj.workspace_entries),
   };
 }
 
+/**
+ * Parses workspace entries with structural validation. Write-time
+ * validation already enforces the git-only constraint, so a malformed
+ * entry here means a converter defect or hand-edited YAML — either way
+ * an error the author must hear about, not a silent skip.
+ */
+function parseAgentCallWorkspaceEntries(
+  raw: unknown,
+): AgentCallConfig["workspace_entries"] {
+  if (raw === undefined || raw === null) return undefined;
+  if (!Array.isArray(raw)) {
+    throw new Error("call:agent 'workspace_entries' must be a list");
+  }
+
+  return raw.map((item, i) => {
+    if (!item || typeof item !== "object" || Array.isArray(item)) {
+      throw new Error(`call:agent 'workspace_entries[${i}]' must be a mapping`);
+    }
+    const entry = item as Record<string, unknown>;
+    const source = entry.source as Record<string, unknown> | undefined;
+    const gitRepo = source?.git_repo as Record<string, unknown> | undefined;
+    if (!gitRepo || typeof gitRepo.url !== "string" || !gitRepo.url) {
+      throw new Error(
+        `call:agent 'workspace_entries[${i}]' requires 'source.git_repo.url' ` +
+        `(the workflow surface supports git sources only)`,
+      );
+    }
+    return {
+      name: typeof entry.name === "string" && entry.name ? entry.name : undefined,
+      source: {
+        git_repo: {
+          url: gitRepo.url,
+          branch: typeof gitRepo.branch === "string" && gitRepo.branch ? gitRepo.branch : undefined,
+        },
+      },
+    };
+  });
+}
+
+/**
+ * Parses the shared RunConfig block with per-key validation rather than a
+ * bare cast: a typo'd key or mistyped value is an authoring error the
+ * author must hear about, not something to silently carry along.
+ */
+function parseAgentCallRunConfig(raw: unknown): AgentCallConfig["run_config"] {
+  if (raw === undefined || raw === null) return undefined;
+  if (typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error("call:agent 'run_config' must be a mapping");
+  }
+  const obj = raw as Record<string, unknown>;
+
+  const known = new Set(["model_name", "max_cost_usd", "max_tool_rounds", "service_tier"]);
+  for (const key of Object.keys(obj)) {
+    if (!known.has(key)) {
+      throw new Error(
+        `call:agent 'run_config' has unknown field '${key}' ` +
+        `(expected: model_name, max_cost_usd, max_tool_rounds, service_tier)`,
+      );
+    }
+  }
+
+  const modelName = obj.model_name;
+  if (modelName !== undefined && typeof modelName !== "string") {
+    throw new Error("call:agent 'run_config.model_name' must be a string");
+  }
+  const maxCostUsd = obj.max_cost_usd;
+  if (maxCostUsd !== undefined && (typeof maxCostUsd !== "number" || maxCostUsd < 0)) {
+    throw new Error("call:agent 'run_config.max_cost_usd' must be a number >= 0");
+  }
+  const maxToolRounds = obj.max_tool_rounds;
+  if (maxToolRounds !== undefined && (typeof maxToolRounds !== "number" || maxToolRounds < 0)) {
+    throw new Error("call:agent 'run_config.max_tool_rounds' must be a number >= 0");
+  }
+  const serviceTier = parseServiceTier(obj.service_tier);
+
+  return {
+    model_name: modelName,
+    max_cost_usd: maxCostUsd,
+    max_tool_rounds: maxToolRounds,
+    service_tier: serviceTier,
+  };
+}
+
+/**
+ * Maps YAML service-tier shorthands to canonical enum names, mirroring
+ * HARNESS_SHORTHANDS. Unknown values are authoring errors: the tier
+ * exists to make pricing deterministic, so a typo must never silently
+ * fall back to the default.
+ */
+const SERVICE_TIER_SHORTHANDS: Record<string, string> = {
+  standard: "SERVICE_TIER_STANDARD",
+  fast: "SERVICE_TIER_FAST",
+};
+
+function parseServiceTier(raw: unknown): string | undefined {
+  if (raw === undefined || raw === null) return undefined;
+  if (typeof raw !== "string") {
+    throw new Error("call:agent 'run_config.service_tier' must be a string");
+  }
+  const canonical =
+    SERVICE_TIER_SHORTHANDS[raw.toLowerCase()] ??
+    (Object.values(SERVICE_TIER_SHORTHANDS).includes(raw) ? raw : undefined);
+  if (!canonical) {
+    throw new Error(
+      `call:agent 'run_config.service_tier' has unknown value '${raw}' ` +
+      `(expected: standard, fast)`,
+    );
+  }
+  return canonical;
+}
+
 function parseHumanInputConfig(taskName: string, raw: unknown): import("./types.js").HumanInputConfig {
   if (!raw || typeof raw !== "object") {
     throw new Error(`human_input task '${taskName}' requires a 'with' configuration block`);

package/src/workflow-engine/tasks/call-agent.ts

@@ -10,8 +10,6 @@
  * This builder is sandbox-safe — it evaluates jq expressions and
  * delegates to `ctx.callAgent()`. The async completion and signal
  * logic live in the workflow-side orchestrator, not here.
- *
- * Mirrors Go's `CallAgentTaskBuilder` in `task_builder_call_agent.go`.
  */
 
 import type {

package/src/workflow-engine/types.ts

@@ -694,22 +694,55 @@ export type CallAgentFn = (
 /**
  * Agent call configuration — mirrors the proto `AgentCallTaskConfig`.
  * Parsed from the YAML `with:` block of a `call: agent` task.
+ *
+ * The agent may be referenced as "slug" (workflow's org) or "org/slug"
+ * (explicit org); there is no separate org field.
  */
 export interface AgentCallConfig {
   readonly agent: string;
   readonly message: string;
-  readonly org?: string;
   readonly env?: Record<string, string>;
-  readonly config?: AgentExecutionCallConfig;
+  readonly run_config?: AgentCallRunConfig;
   readonly output?: AgentCallOutputContract;
   readonly harness?: string;
+  readonly workspace_entries?: readonly AgentCallWorkspaceEntry[];
 }
 
-export interface AgentExecutionCallConfig {
-  readonly model?: string;
-  readonly timeout?: number;
-  readonly temperature?: number;
-  readonly max_cost_micros?: number;
+/**
+ * Mirrors the shared `ai.stigmer.agentic.session.v1.WorkspaceEntry` in its
+ * git-only form — the workflow surface rejects local_path sources at write
+ * time (no client is connected to serve one when a task fires), so by the
+ * time YAML reaches the runner only git_repo entries exist.
+ *
+ * The task's `environment_refs` sibling never appears in execution YAML:
+ * the server resolves it from the Workflow row at execution create.
+ */
+export interface AgentCallWorkspaceEntry {
+  readonly name?: string;
+  readonly source: {
+    readonly git_repo: {
+      readonly url: string;
+      readonly branch?: string;
+    };
+  };
+}
+
+/**
+ * Mirrors the shared `ai.stigmer.agentic.agentexecution.v1.RunConfig`
+ * (issue #358) — the same run-bound vocabulary schedules embed. Every
+ * field maps onto its `ExecutionConfig` namesake and is enforced by the
+ * runner's generic cost/tool-round guards; nothing here is decorative.
+ */
+export interface AgentCallRunConfig {
+  readonly model_name?: string;
+  readonly max_cost_usd?: number;
+  readonly max_tool_rounds?: number;
+  /**
+   * Canonical ServiceTier enum name ("SERVICE_TIER_STANDARD" /
+   * "SERVICE_TIER_FAST"); the loader maps the YAML shorthands
+   * ("standard"/"fast") to these, mirroring harness.
+   */
+  readonly service_tier?: string;
 }
 
 export interface AgentCallOutputContract {

package/src/workflows/call-agent-orchestrator.ts

@@ -8,8 +8,9 @@
  * 4. Updating workflow approval status via local activities
  * 5. Returning the agent result when the activity completes
  *
- * The kernel's CallAgentTaskBuilder calls `ctx.callAgent()`, which
- * is wired to `orchestrateAgentCall()` in execute-serverless-workflow.ts.
+ * The workflow engine's CallAgentTaskBuilder (workflow-engine/tasks/
+ * call-agent.ts) calls `ctx.callAgent()`, which is wired to
+ * `orchestrateAgentCall()` in execute-serverless-workflow.ts.
  *
  * SANDBOX RULES: Only @temporalio/workflow imports, type-only imports,
  * and pure logic. No Node.js built-ins.
@@ -54,6 +55,11 @@ type AgentActivities = ReturnType<typeof createCallAgentActivities>;
 type StatusActivities = ReturnType<typeof createCallAgentStatusActivities>;
 type EventActivities = ReturnType<typeof createWorkflowEventActivities>;
 
+// The 1h ceiling is a deliberate platform constant, not a user knob: the
+// old AgentCallTaskConfig declared a per-task `timeout` that nothing ever
+// read, and #358 deleted it rather than declaring what isn't honored. The
+// real per-run bound is run_config.max_cost_usd, enforced inside the
+// agent execution itself.
 const agentProxy = proxyActivities<AgentActivities>({
   startToCloseTimeout: "1h",
   retry: {