@stigmer/server 3.36.0 → 3.37.1

package/src/pipeline/steps/guard-memory-capture.ts

@@ -14,7 +14,12 @@
  * every Stigmer-minted non-first-party credential carries the
  * `platform_client_id` claim (StigmerJwtIssuer stamps it on user, guest,
  * channel, and schedule tokens alike), so its presence IS the exclusion
- * the Java RequestCallerIdentity.isFirstPartyHumanOperator computes.
+ * the Java RequestCallerIdentity.isFirstPartyHumanOperator computes. The
+ * claim counts only on a platform token (`iss: "stigmer"`, read through
+ * decodeVerifiedPlatformTokenPayload as the PlatformClient origin guard
+ * reads it): a bearer another verifier claimed is some other issuer's,
+ * whatever claims it carries, and is never taken for a Stigmer-minted
+ * one (stigmer#1312).
  *
  * RUNNER credentials carry neither the machine class nor that claim —
  * their eligibility is EDITION POLICY, so the gate consults the composed
@@ -30,16 +35,21 @@
  * this gate's own logic applies). The capability throws its own
  * byte-pinned refusal for the org-mismatch arm. With no capability
  * composed the gate's logic is byte-identical to before the seam: OSS
- * trusted-local callers carry no token and OIDC console logins carry no
- * platform_client_id claim — the step admits both, so the single-user
- * posture is unchanged (proven by the rosters).
+ * trusted-local callers carry no token and OIDC console logins are not
+ * platform tokens — the step admits both, so the single-user posture is
+ * unchanged (proven by the rosters).
  */
 import type { DescMessage } from "@bufbuild/protobuf";
 import { Code, ConnectError } from "@connectrpc/connect";
 
+import { USER_TOKEN_CLAIMS } from "../../domain/platformclient/constants.js";
 import { isServerComposedRequest } from "../../extensions/identity.js";
 import type { PipelineStep } from "../pipeline.js";
 import type { RequestContext } from "../request-context.js";
+import {
+  decodeVerifiedPlatformTokenPayload,
+  stringClaim,
+} from "../../platformtoken/envelope.js";
 import type { RunnerCredentialProvider } from "../../runnerauth/runner-credential-provider.js";
 import { metadataOf } from "./shapes.js";
 
@@ -138,20 +148,15 @@ export function memoryCaptureCredentialOf<Desc extends DescMessage>(
   return undefined;
 }
 
+/**
+ * Whether the bearer is a platform token naming a PlatformClient. Anything
+ * that is not a platform token (no token, an API key, another issuer's
+ * JWT) is not one, whatever claims it carries.
+ */
 function carriesPlatformClientClaim(rawToken: string): boolean {
-  const segments = rawToken.split(".");
-  if (segments.length !== 3) {
-    return false; // not a JWT — the trusted-local no-token posture
-  }
-  try {
-    const payload = JSON.parse(
-      Buffer.from(segments[1], "base64url").toString("utf8"),
-    ) as { platform_client_id?: unknown };
-    return (
-      typeof payload.platform_client_id === "string" &&
-      payload.platform_client_id !== ""
-    );
-  } catch {
-    return false;
-  }
+  const payload = decodeVerifiedPlatformTokenPayload(rawToken);
+  return (
+    payload !== undefined &&
+    stringClaim(payload, USER_TOKEN_CLAIMS.platformClientId) !== undefined
+  );
 }

package/src/temporal/agentexecution/__tests__/invoke-workflow.test.ts

@@ -16,6 +16,10 @@
  *   - bounded auto-recovery on worker-shutdown shapes (#776: IN_PROGRESS
  *     persisted, honest status copy on exhaustion);
  *   - EXECUTION_FAILED propagation with the fallback persist;
+ *   - the stop and failure copy each has one writer (stigmer#980): the
+ *     pause persist carries the pause row, a runner-reported failure's
+ *     write carries no lines (the runner explained it), and only a broken
+ *     flow gets the platform's two lines;
  *   - external cancellation cleanup (CANCELLED persisted quietly —
  *     stigmer#282 — and the EC deleted);
  *   - callback-token completion on success AND failure (the DD-001 lane,
@@ -50,9 +54,15 @@ import type { AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/ag
 import {
   ExecutionPhase,
   FileChangeSetStatus,
+  MessageType,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { Harness } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
 
+import {
+  CANCEL_STOP_ROW,
+  PAUSE_STOP_ROW,
+} from "../../../domain/agentexecution/platform-rows.js";
+
 import {
   INVOKE_AGENT_EXECUTION_WORKFLOW_NAME,
   MEMO_ACTIVITY_TASK_QUEUE,
@@ -565,6 +575,12 @@ describe("invoke-agent-execution workflow (TestWorkflowEnvironment)", () => {
         .includes(ExecutionPhase.EXECUTION_IN_PROGRESS),
       "resume re-asserts IN_PROGRESS after the PAUSED persist",
     ).toBe(true);
+    // The workflow is the pause row's one writer: the runner cannot tell
+    // this stop from a cancel, so it settles without a row.
+    expect(
+      script.persistedStatuses[pausedAt]!.status.messages.map((m) => [m.type, m.content]),
+      "the PAUSED persist carries the pause row",
+    ).toEqual([[MessageType.MESSAGE_SYSTEM, PAUSE_STOP_ROW]]);
   }, 60_000);
 
   it("auto-recovers a worker-shutdown interruption and persists IN_PROGRESS (#776)", async (testCtx) => {    if (!envReady) return testCtx.skip();
@@ -611,6 +627,40 @@ describe("invoke-agent-execution workflow (TestWorkflowEnvironment)", () => {
     );
     expect(failed.length).toBeGreaterThan(0);
     expect(failed[0]!.status.error).toBe("agent blew up");
+    // The runner already explained its own failure in the transcript, so
+    // no FAILED write of the workflow adds a second explanation.
+    expect(
+      failed.flatMap((entry) => entry.status.messages),
+      "a runner-reported failure adds no platform lines",
+    ).toEqual([]);
+    expectExecutionContextDeleted();
+  }, 30_000);
+
+  it("explains a flow that broke without a runner verdict with the platform's two lines", async (testCtx) => {    if (!envReady) return testCtx.skip();
+    const { ApplicationFailure } = await import("@temporalio/common");
+    script.executeBehaviors = [
+      async () => {
+        // Not recoverable (not a cancellation, heartbeat timeout or worker
+        // shutdown), so the flow breaks with no FAILED result to read.
+        throw ApplicationFailure.create({ message: "runner crashed", nonRetryable: true });
+      },
+    ];
+
+    const handle = await startWorkflow(workflowInput());
+    await expect(handle.result()).rejects.toThrow(/Workflow execution failed/);
+
+    const failed = script.persistedStatuses.filter(
+      (entry) => entry.status.phase === ExecutionPhase.EXECUTION_FAILED,
+    );
+    expect(failed.length).toBeGreaterThan(0);
+    const lines = failed.at(-1)!.status.messages;
+    expect(lines.map((m) => m.type)).toEqual([
+      MessageType.MESSAGE_SYSTEM,
+      MessageType.MESSAGE_SYSTEM,
+    ]);
+    // The details carry the wrapped activity error (wrapActivityError's
+    // operator-actionable prefix), not a runner-authored sentence.
+    expect(lines[1]!.content).toMatch(/^Error details: activity 'ExecuteDeepAgent'/);
     expectExecutionContextDeleted();
   }, 30_000);
 
@@ -638,7 +688,7 @@ describe("invoke-agent-execution workflow (TestWorkflowEnvironment)", () => {
     // system message is the durable marker.
     expect(cancelled.status.error).toBe("");
     expect(cancelled.status.messages.map((message) => message.content)).toEqual([
-      "Execution was cancelled.",
+      CANCEL_STOP_ROW,
     ]);
     expectExecutionContextDeleted();
   }, 60_000);

package/src/temporal/agentexecution/__tests__/own-behalf-status-writes.test.ts

@@ -20,19 +20,24 @@
  * execution status` from authorize.ts — the dark production composition's
  * exact log line.
  *
- * The three payload shapes are the workflow's real ones
+ * The payload shapes are the workflow's real ones
  * (invoke-agent-execution.ts): updateStatusOnFailure's FAILED with two
- * MESSAGE_SYSTEM lines, updateStatusOnCancellation's CANCELLED with one,
+ * MESSAGE_SYSTEM lines (a flow that broke) or none (a runner-reported
+ * failure), updateStatusOnCancellation's CANCELLED with its stop row,
  * and the phase-only persistFinalStatus / persistInterruptedStatus /
- * persistResumedStatus shape. Transcript shape after a late fallback is
- * deliberately NOT asserted here — stigmer#980 owns that cross-edition
- * behavior.
+ * persistResumedStatus shape.
+ *
+ * The last arms pin the transcript a stopped execution keeps over this
+ * production lane (stigmer#980): the platform's lines are appended to the
+ * runner's transcript, never substituted for it, and the cancel row stays
+ * last when the runner's settle write lands after it. The merge's full
+ * case matrix is domain/agentexecution/__tests__/update-status.test.ts.
  */
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { create, toJson } from "@bufbuild/protobuf";
-import type { JsonValue } from "@bufbuild/protobuf";
+import type { JsonValue, MessageInitShape } from "@bufbuild/protobuf";
 import { createClient } from "@connectrpc/connect";
 import type { Client } from "@temporalio/client";
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
@@ -46,9 +51,12 @@ import {
   ExecutionPhase,
   MessageType,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { AgentExecutionUpdateStatusInputSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/io_pb";
+import type { AgentMessageSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 
 import { loadConfig } from "../../../boot/config.js";
+import { CANCEL_STOP_ROW } from "../../../domain/agentexecution/platform-rows.js";
 import { composeServer } from "../../../boot/compose.js";
 import type { ComposedServer } from "../../../boot/compose.js";
 import { createLogger } from "../../../boot/logger.js";
@@ -147,7 +155,11 @@ describe("own-behalf status writes under an enforcing Authorizer", () => {
     transitions.length = 0;
   });
 
-  async function seedExecution(id: string): Promise<void> {
+  async function seedExecution(
+    id: string,
+    phase: ExecutionPhase = ExecutionPhase.EXECUTION_IN_PROGRESS,
+    messages: MessageInitShape<typeof AgentMessageSchema>[] = [],
+  ): Promise<void> {
     // Seeded through the store: the create path is not under test, and
     // the denying Authorizer would refuse it over the wire.
     await server.store.saveResource(
@@ -159,7 +171,7 @@ describe("own-behalf status writes under an enforcing Authorizer", () => {
         kind: "AgentExecution",
         metadata: { id, name: "own-behalf", org: "acme" },
         spec: { agentId: "agt_1", sessionId: "ses_1" },
-        status: { phase: ExecutionPhase.EXECUTION_IN_PROGRESS },
+        status: { phase, messages },
       }),
     );
   }
@@ -253,7 +265,7 @@ describe("own-behalf status writes under an enforcing Authorizer", () => {
           messages: [
             {
               type: MessageType.MESSAGE_SYSTEM,
-              content: "Execution was cancelled.",
+              content: CANCEL_STOP_ROW,
             },
           ],
         }),
@@ -296,6 +308,134 @@ describe("own-behalf status writes under an enforcing Authorizer", () => {
     expect(authorizerCalls).toHaveLength(0);
   });
 
+  describe("the transcript a stopped execution keeps (stigmer#980)", () => {
+    const runnerTurns = [
+      { type: MessageType.MESSAGE_AI, content: "a1" },
+      { type: MessageType.MESSAGE_AI, content: "a2" },
+    ];
+
+    async function transcriptOf(id: string): Promise<string[]> {
+      return ((await persisted(id)).status?.messages ?? []).map(
+        (m) => m.content,
+      );
+    }
+
+    it("appends the cancel row to a transcript the Cancel RPC already stamped CANCELLED, and keeps it last across the runner's late settle write", async () => {
+      await seedExecution(
+        "aex_ownbehalf_cancel_race",
+        ExecutionPhase.EXECUTION_CANCELLED,
+        runnerTurns,
+      );
+
+      await updateStatus(
+        "aex_ownbehalf_cancel_race",
+        toJson(
+          AgentExecutionStatusSchema,
+          create(AgentExecutionStatusSchema, {
+            phase: ExecutionPhase.EXECUTION_CANCELLED,
+            messages: [
+              { type: MessageType.MESSAGE_SYSTEM, content: CANCEL_STOP_ROW },
+            ],
+          }),
+        ),
+      );
+      expect(await transcriptOf("aex_ownbehalf_cancel_race")).toEqual([
+        "a1",
+        "a2",
+        CANCEL_STOP_ROW,
+      ]);
+
+      // The runner learns of the cancel on its next heartbeat and settles
+      // its transcript over the same handler, with no row and no phase.
+      await statusWriter.updateStatus(
+        create(AgentExecutionUpdateStatusInputSchema, {
+          executionId: "aex_ownbehalf_cancel_race",
+          status: {
+            messages: [
+              ...runnerTurns,
+              { type: MessageType.MESSAGE_AI, content: "a3" },
+            ],
+          },
+        }),
+      );
+      expect(await transcriptOf("aex_ownbehalf_cancel_race")).toEqual([
+        "a1",
+        "a2",
+        "a3",
+        CANCEL_STOP_ROW,
+      ]);
+    });
+
+    it("appends a broken flow's two lines to the runner's transcript", async () => {
+      await seedExecution(
+        "aex_ownbehalf_broken_flow",
+        ExecutionPhase.EXECUTION_IN_PROGRESS,
+        runnerTurns,
+      );
+
+      await updateStatus(
+        "aex_ownbehalf_broken_flow",
+        toJson(
+          AgentExecutionStatusSchema,
+          create(AgentExecutionStatusSchema, {
+            phase: ExecutionPhase.EXECUTION_FAILED,
+            error: "activity crashed",
+            messages: [
+              {
+                type: MessageType.MESSAGE_SYSTEM,
+                content: "Internal system error occurred during execution.",
+              },
+              {
+                type: MessageType.MESSAGE_SYSTEM,
+                content: "Error details: activity crashed",
+              },
+            ],
+          }),
+        ),
+      );
+
+      const execution = await persisted("aex_ownbehalf_broken_flow");
+      expect(execution.status?.phase).toBe(ExecutionPhase.EXECUTION_FAILED);
+      expect(await transcriptOf("aex_ownbehalf_broken_flow")).toEqual([
+        "a1",
+        "a2",
+        "Internal system error occurred during execution.",
+        "Error details: activity crashed",
+      ]);
+    });
+
+    it("leaves a runner-reported failure's transcript as the runner wrote it", async () => {
+      await seedExecution(
+        "aex_ownbehalf_runner_failed",
+        ExecutionPhase.EXECUTION_FAILED,
+        [
+          ...runnerTurns,
+          {
+            type: MessageType.MESSAGE_SYSTEM,
+            content: "Execution failed: the tool refused",
+          },
+        ],
+      );
+
+      await updateStatus(
+        "aex_ownbehalf_runner_failed",
+        toJson(
+          AgentExecutionStatusSchema,
+          create(AgentExecutionStatusSchema, {
+            phase: ExecutionPhase.EXECUTION_FAILED,
+            error: "agent execution failed: the tool refused",
+          }),
+        ),
+      );
+
+      expect(await transcriptOf("aex_ownbehalf_runner_failed")).toEqual([
+        "a1",
+        "a2",
+        "Execution failed: the tool refused",
+      ]);
+    });
+  });
+
   it("surfaces the lane's NotFound as the activity's failure for a deleted execution", async () => {
     await expect(
       updateStatus("aex_ownbehalf_missing", { phase: "EXECUTION_FAILED" }),