@stigmer/server 3.38.2 → 3.38.3

package/src/domain/artifact/__tests__/store-faults.test.ts

@@ -0,0 +1,117 @@
+/**
+ * Pins the store-fault contract the artifact load by id shares: a typed
+ * ResourceNotFoundError answers NotFound with the domain's pinned Go copy
+ * (`Artifact not found: <id>`), and any other store failure is an
+ * infrastructure fault answered as a sanitized Internal, never a NotFound
+ * that tells a client a run's output does not exist (stigmer/stigmer#1345).
+ *
+ * The surfaces: the three direct handlers that load through
+ * loadArtifactOrNotFound, delete, getDownloadUrl and getContent, each
+ * reached through the registered handler on an in-process router. All three
+ * load before they authorize (stigmer#224), and a fault answered as Internal
+ * says nothing about whether the artifact exists. The composed suites reach
+ * only a real store, which cannot fail selectively, so each surface runs here
+ * against a store whose read throws. Artifact storage is untouchable: a load
+ * that fails must stop the call before any blob read or URL mint.
+ *
+ * Out of scope: the NotFound copy itself (wire contract, pinned by the
+ * artifact conformance suite) and create's best-effort org derivation
+ * (stigmer/stigmer#1369).
+ */
+import type { Client, ConnectError } from "@connectrpc/connect";
+import { Code, createClient, createRouterTransport } from "@connectrpc/connect";
+import { describe, expect, it } from "vitest";
+
+import { ArtifactCommandController } from "@stigmer/protos/ai/stigmer/agentic/artifact/v1/command_pb";
+import { ArtifactQueryController } from "@stigmer/protos/ai/stigmer/agentic/artifact/v1/query_pb";
+
+import { createLogger } from "../../../boot/logger.js";
+import { createVerifierChainInterceptor } from "../../../pipeline/interceptors/auth.js";
+import {
+  errorOf,
+  failingStore,
+  untouchable,
+} from "../../../pipeline/__tests__/support.js";
+import { newPermissiveSingleTeamAuthorizer } from "../../../pipeline/steps/authorize.js";
+import { ResourceNotFoundError } from "../../../store/interface.js";
+import type { Store } from "../../../store/interface.js";
+
+import { registerArtifactServices } from "../controller.js";
+
+const silentLogger = createLogger({
+  level: "error",
+  pretty: false,
+  write: () => {},
+});
+
+const ARTIFACT_ID = "art_storefault";
+
+const NOT_FOUND_COPY = `Artifact not found: ${ARTIFACT_ID}`;
+const LOAD_FAULT_COPY = "failed to load artifact";
+
+const MISSING = (): Error =>
+  new ResourceNotFoundError(`artifact/${ARTIFACT_ID}`);
+const LOCKED = (): Error => new Error("SQLITE_BUSY: database is locked");
+
+interface ArtifactClients {
+  readonly command: Client<typeof ArtifactCommandController>;
+  readonly query: Client<typeof ArtifactQueryController>;
+}
+
+/**
+ * The registered handlers on an in-process router (`artifact.test.ts`'s
+ * harness): the verifier chain stamps the trusted-local caller, each handler
+ * checks its id, and the load is the first read of the store.
+ */
+function artifactClients(store: Store): ArtifactClients {
+  const transport = createRouterTransport(
+    (router) => {
+      registerArtifactServices(router, {
+        store,
+        artifactStorage: untouchable("artifactStorage"),
+        logger: silentLogger,
+        authorizer: newPermissiveSingleTeamAuthorizer(),
+      });
+    },
+    {
+      router: {
+        interceptors: [createVerifierChainInterceptor([], [], silentLogger)],
+      },
+    },
+  );
+  return {
+    command: createClient(ArtifactCommandController, transport),
+    query: createClient(ArtifactQueryController, transport),
+  };
+}
+
+const SURFACES: ReadonlyArray<
+  readonly [string, (clients: ArtifactClients) => Promise<unknown>]
+> = [
+  ["delete", ({ command }) => command.delete({ value: ARTIFACT_ID })],
+  [
+    "getDownloadUrl",
+    ({ query }) => query.getDownloadUrl({ value: ARTIFACT_ID }),
+  ],
+  ["getContent", ({ query }) => query.getContent({ artifactId: ARTIFACT_ID })],
+];
+
+describe.each(SURFACES)("%s — loadArtifactOrNotFound", (_name, call) => {
+  function surfaceError(store: Store): Promise<ConnectError> {
+    return errorOf(() => call(artifactClients(store)));
+  }
+
+  it("a missing artifact answers NotFound with the domain's copy", async () => {
+    const error = await surfaceError(failingStore(MISSING()));
+
+    expect(error.code).toBe(Code.NotFound);
+    expect(error.rawMessage).toBe(NOT_FOUND_COPY);
+  });
+
+  it("any other store failure answers a sanitized Internal", async () => {
+    const error = await surfaceError(failingStore(LOCKED()));
+
+    expect(error.code).toBe(Code.Internal);
+    expect(error.rawMessage).toBe(LOAD_FAULT_COPY);
+  });
+});

package/src/domain/artifact/controller.ts

@@ -9,7 +9,8 @@
  * storage_state transition rather than the hard-delete pipeline; only
  * get/listByExecution ride pipelines. Proven by
  * artifact.conformance.test.ts (CONFORMANCE_TARGET=local, incl. the
- * file-server lane) and __tests__/artifact.test.ts.
+ * file-server lane), __tests__/artifact.test.ts and
+ * __tests__/store-faults.test.ts.
  *
  * Go tolerates a nil ArtifactStorage (two-phase wiring) and answers
  * Internal "artifact storage not configured"; the TS composition root
@@ -79,6 +80,7 @@ import {
   newLoadTargetStep,
 } from "../../pipeline/steps/load-target.js";
 import { newValidateProtoStep } from "../../pipeline/steps/validation.js";
+import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import type { ListIndexRow } from "../../store/list-index.js";
 import { artifactListIndex } from "./list-index.js";
@@ -649,7 +651,7 @@ async function getContent(
   });
 }
 
-/** Load by id with the byte-pinned Go NotFound copy. */
+/** Load by id: a missing artifact answers the byte-pinned Go NotFound copy, a store fault Internal. */
 async function loadArtifactOrNotFound(
   deps: ArtifactControllerDeps,
   artifactId: string,
@@ -660,10 +662,14 @@ async function loadArtifactOrNotFound(
       artifactId,
       ArtifactSchema,
     );
-  } catch {
-    // Go answers NotFound for ANY store failure here (status.Errorf on
-    // err != nil), not only missing rows — mirrored.
-    throw new ConnectError(artifactNotFoundMessage(artifactId), Code.NotFound);
+  } catch (error) {
+    if (error instanceof ResourceNotFoundError) {
+      throw new ConnectError(
+        artifactNotFoundMessage(artifactId),
+        Code.NotFound,
+      );
+    }
+    throw internalError(error, "failed to load artifact");
   }
 }
 

package/src/domain/environment/__tests__/store-faults.test.ts

@@ -0,0 +1,150 @@
+/**
+ * Pins the store-fault contract every environment load by id shares: a typed
+ * ResourceNotFoundError answers NotFound with the domain's pinned copy
+ * (`environment not found: <id>`), and any other store failure is an
+ * infrastructure fault answered as a sanitized Internal, never a NotFound
+ * that tells a client the environment does not exist
+ * (stigmer/stigmer#1345).
+ *
+ * The surfaces: updateVisibility (its own load step) and the three RPCs that
+ * share LoadEnvironmentByID, updateVariables, removeVariables and
+ * getSecretValue, each reached through the registered handler on an
+ * in-process router. The composed suites reach only a real store, which
+ * cannot fail selectively, so each surface runs here against a store whose
+ * read throws. The secret service is untouchable: a load that fails must stop
+ * the call before any decrypt or encrypt.
+ *
+ * Out of scope: the NotFound copy itself (wire contract, pinned by
+ * environment.test.ts and the environment conformance suite) and the
+ * personal-environment resolver's fold of a failed secret read into a
+ * missing key (stigmer/stigmer#1360).
+ */
+import type { Client, ConnectError } from "@connectrpc/connect";
+import { Code, createClient, createRouterTransport } from "@connectrpc/connect";
+import { describe, expect, it } from "vitest";
+
+import { EnvironmentCommandController } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/command_pb";
+import { EnvironmentQueryController } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/query_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+
+import { createLogger } from "../../../boot/logger.js";
+import { createApiResourceInterceptor } from "../../../pipeline/interceptors/apiresource.js";
+import { createVerifierChainInterceptor } from "../../../pipeline/interceptors/auth.js";
+import {
+  errorOf,
+  failingStore,
+  untouchable,
+} from "../../../pipeline/__tests__/support.js";
+import { newPermissiveSingleTeamAuthorizer } from "../../../pipeline/steps/authorize.js";
+import { ResourceNotFoundError } from "../../../store/interface.js";
+import type { Store } from "../../../store/interface.js";
+
+import { registerEnvironmentServices } from "../controller.js";
+
+const silentLogger = createLogger({
+  level: "error",
+  pretty: false,
+  write: () => {},
+});
+
+const ENVIRONMENT_ID = "env_storefault";
+
+const NOT_FOUND_COPY = `environment not found: ${ENVIRONMENT_ID}`;
+const LOAD_FAULT_COPY = "failed to load environment";
+
+const MISSING = (): Error =>
+  new ResourceNotFoundError(`environment/${ENVIRONMENT_ID}`);
+const LOCKED = (): Error => new Error("SQLITE_BUSY: database is locked");
+
+interface EnvironmentClients {
+  readonly command: Client<typeof EnvironmentCommandController>;
+  readonly query: Client<typeof EnvironmentQueryController>;
+}
+
+/**
+ * The registered handlers on an in-process router: the verifier chain stamps
+ * the trusted-local caller and the apiresource interceptor the kind both
+ * loads read, then Authorize and ValidateProto run and the load is the first
+ * step that reads the store.
+ */
+function environmentClients(store: Store): EnvironmentClients {
+  const transport = createRouterTransport(
+    (router) => {
+      registerEnvironmentServices(router, {
+        store,
+        logger: silentLogger,
+        authorizer: newPermissiveSingleTeamAuthorizer(),
+        authorizationLifecycle: undefined,
+        secretService: untouchable("secretService"),
+        listReadScope: undefined,
+      });
+    },
+    {
+      router: {
+        interceptors: [
+          createVerifierChainInterceptor([], [], silentLogger),
+          createApiResourceInterceptor(),
+        ],
+      },
+    },
+  );
+  return {
+    command: createClient(EnvironmentCommandController, transport),
+    query: createClient(EnvironmentQueryController, transport),
+  };
+}
+
+/** Each surface with an input valid enough to pass ValidateProto. */
+const SURFACES: ReadonlyArray<
+  readonly [string, (clients: EnvironmentClients) => Promise<unknown>]
+> = [
+  [
+    "updateVisibility — LoadEnvironmentForVisibilityUpdate",
+    ({ command }) =>
+      command.updateVisibility({
+        resourceId: ENVIRONMENT_ID,
+        visibility: ApiResourceVisibility.visibility_private,
+      }),
+  ],
+  [
+    "updateVariables — LoadEnvironmentByID",
+    ({ command }) =>
+      command.updateVariables({
+        environmentId: ENVIRONMENT_ID,
+        variables: { API_KEY: { value: "v", isSecret: false } },
+      }),
+  ],
+  [
+    "removeVariables — LoadEnvironmentByID",
+    ({ command }) =>
+      command.removeVariables({
+        environmentId: ENVIRONMENT_ID,
+        keys: ["API_KEY"],
+      }),
+  ],
+  [
+    "getSecretValue — LoadEnvironmentByID",
+    ({ query }) =>
+      query.getSecretValue({ environmentId: ENVIRONMENT_ID, key: "API_KEY" }),
+  ],
+];
+
+describe.each(SURFACES)("%s", (_name, call) => {
+  function surfaceError(store: Store): Promise<ConnectError> {
+    return errorOf(() => call(environmentClients(store)));
+  }
+
+  it("a missing environment answers NotFound with the domain's copy", async () => {
+    const error = await surfaceError(failingStore(MISSING()));
+
+    expect(error.code).toBe(Code.NotFound);
+    expect(error.rawMessage).toBe(NOT_FOUND_COPY);
+  });
+
+  it("any other store failure answers a sanitized Internal", async () => {
+    const error = await surfaceError(failingStore(LOCKED()));
+
+    expect(error.code).toBe(Code.Internal);
+    expect(error.rawMessage).toBe(LOAD_FAULT_COPY);
+  });
+});

package/src/domain/environment/controller.ts

@@ -8,8 +8,8 @@
  * design: limited blast radius, per-key audit, the industry "reveal" UX).
  *
  * Pipeline per RPC mirrors the Go step chains character-for-character.
- * Proven by environment.conformance.test.ts (CONFORMANCE_TARGET=local)
- * and __tests__/environment.test.ts.
+ * Proven by environment.conformance.test.ts (CONFORMANCE_TARGET=local),
+ * __tests__/environment.test.ts and __tests__/store-faults.test.ts.
  *
  * Versus Stigmer Cloud, OSS excludes the Authorize, CreateIamPolicies,
  * FGA-tuple, and Publish steps (no multi-tenant auth, IAM/FGA, or event
@@ -421,7 +421,7 @@ async function updateVisibility(
   return env;
 }
 
-/** Loads the environment by resource_id; ANY load failure → NotFound. */
+/** Loads the environment by resource_id; a missing one answers NotFound, a store fault Internal. */
 function newLoadEnvironmentForVisibilityUpdateStep(
   store: Store,
 ): PipelineStep<UpdateVisibilityDesc> {
@@ -436,8 +436,11 @@ function newLoadEnvironmentForVisibilityUpdateStep(
           input.resourceId,
           EnvironmentSchema,
         );
-      } catch {
-        throw notFoundError("environment", input.resourceId);
+      } catch (error) {
+        if (error instanceof ResourceNotFoundError) {
+          throw notFoundError("environment", input.resourceId);
+        }
+        throw internalError(error, "failed to load environment");
       }
       ctx.set(UPDATE_VISIBILITY_ENVIRONMENT_KEY, env);
     },

package/src/domain/environment/steps.ts

@@ -15,8 +15,8 @@
  *      by design and must not hit the forgery rejection.
  *   3. Redaction (redact.ts) runs AFTER Persist, outside the pipeline.
  *
- * Proven by environment.conformance.test.ts (CONFORMANCE_TARGET=local)
- * and __tests__/environment.test.ts.
+ * Proven by environment.conformance.test.ts (CONFORMANCE_TARGET=local),
+ * __tests__/environment.test.ts and __tests__/store-faults.test.ts.
  */
 import { create } from "@bufbuild/protobuf";
 import type { DescMessage } from "@bufbuild/protobuf";
@@ -51,6 +51,7 @@ import { findResourceByLabelAndOrg } from "../../pipeline/steps/helpers.js";
 import { EXISTING_RESOURCE_KEY } from "../../pipeline/steps/load-existing.js";
 import { TARGET_RESOURCE_KEY } from "../../pipeline/steps/load-target.js";
 import { destroySecretBackingState } from "../../pipeline/steps/secret-cleanup.js";
+import { ResourceNotFoundError } from "../../store/interface.js";
 import type { Store } from "../../store/interface.js";
 import {
   PERSONAL_LABEL_KEY,
@@ -273,7 +274,8 @@ export function newEnforcePersonalUniquenessStep(
  * environment_id field (the standard LoadTarget expects a `value` id
  * field, but EnvironmentSecretValueInput / Update-/RemoveEnvironment-
  * VariablesRequest carry `environment_id`). Stores under
- * TARGET_RESOURCE_KEY.
+ * TARGET_RESOURCE_KEY. A missing environment answers NotFound, a store
+ * fault Internal.
  */
 export function newLoadEnvironmentByIdStep<Desc extends DescMessage>(
   store: Store,
@@ -294,10 +296,11 @@ export function newLoadEnvironmentByIdStep<Desc extends DescMessage>(
           environmentId,
           EnvironmentSchema,
         );
-      } catch {
-        // Go maps EVERY load failure to NotFound here (store errors
-        // included) — ported as-is.
-        throw notFoundError("environment", environmentId);
+      } catch (error) {
+        if (error instanceof ResourceNotFoundError) {
+          throw notFoundError("environment", environmentId);
+        }
+        throw internalError(error, "failed to load environment");
       }
 
       ctx.set(TARGET_RESOURCE_KEY, env);

package/src/domain/workflow/registry/data/model-registry.json

@@ -963,7 +963,8 @@
       "vision" : true,
       "streaming" : true,
       "thinking" : false,
-      "adaptiveThinking" : true
+      "adaptiveThinking" : true,
+      "thinkingRequired" : true
     }
   }, {
     "id" : "claude-haiku-4.5",
@@ -995,8 +996,9 @@
       "toolUse" : true,
       "vision" : true,
       "streaming" : true,
-      "thinking" : false,
-      "adaptiveThinking" : false
+      "thinking" : true,
+      "adaptiveThinking" : false,
+      "thinkingRequired" : false
     }
   }, {
     "id" : "claude-opus-4.5",
@@ -1017,7 +1019,7 @@
       "effectiveAt" : "2026-05-03T00:00:00Z"
     },
     "contextWindowTokens" : 200000,
-    "maxOutputTokens" : 65536,
+    "maxOutputTokens" : 64000,
     "tokenCounterMethod" : "anthropic_native",
     "summarization" : {
       "triggerThreshold" : 180000,
@@ -1029,7 +1031,8 @@
       "vision" : true,
       "streaming" : true,
       "thinking" : true,
-      "adaptiveThinking" : false
+      "adaptiveThinking" : false,
+      "thinkingRequired" : false
     }
   }, {
     "id" : "claude-opus-4.6",
@@ -1050,7 +1053,7 @@
       "effectiveAt" : "2026-05-03T00:00:00Z"
     },
     "contextWindowTokens" : 200000,
-    "maxOutputTokens" : 131072,
+    "maxOutputTokens" : 128000,
     "tokenCounterMethod" : "anthropic_native",
     "summarization" : {
       "triggerThreshold" : 180000,
@@ -1062,7 +1065,8 @@
       "vision" : true,
       "streaming" : true,
       "thinking" : false,
-      "adaptiveThinking" : true
+      "adaptiveThinking" : true,
+      "thinkingRequired" : false
     }
   }, {
     "id" : "claude-opus-4.7",
@@ -1096,7 +1100,8 @@
       "vision" : true,
       "streaming" : true,
       "thinking" : false,
-      "adaptiveThinking" : true
+      "adaptiveThinking" : true,
+      "thinkingRequired" : false
     }
   }, {
     "id" : "claude-opus-4.8",
@@ -1130,7 +1135,8 @@
       "vision" : true,
       "streaming" : true,
       "thinking" : false,
-      "adaptiveThinking" : true
+      "adaptiveThinking" : true,
+      "thinkingRequired" : false
     }
   }, {
     "id" : "claude-sonnet-4.5",
@@ -1151,7 +1157,7 @@
       "effectiveAt" : "2026-05-03T00:00:00Z"
     },
     "contextWindowTokens" : 200000,
-    "maxOutputTokens" : 65536,
+    "maxOutputTokens" : 64000,
     "tokenCounterMethod" : "anthropic_native",
     "summarization" : {
       "triggerThreshold" : 180000,
@@ -1163,7 +1169,8 @@
       "vision" : true,
       "streaming" : true,
       "thinking" : true,
-      "adaptiveThinking" : false
+      "adaptiveThinking" : false,
+      "thinkingRequired" : false
     }
   }, {
     "id" : "claude-sonnet-4.6",
@@ -1195,8 +1202,9 @@
       "toolUse" : true,
       "vision" : true,
       "streaming" : true,
-      "thinking" : true,
-      "adaptiveThinking" : false
+      "thinking" : false,
+      "adaptiveThinking" : true,
+      "thinkingRequired" : false
     }
   }, {
     "id" : "claude-sonnet-5",
@@ -1230,7 +1238,8 @@
       "vision" : true,
       "streaming" : true,
       "thinking" : false,
-      "adaptiveThinking" : true
+      "adaptiveThinking" : true,
+      "thinkingRequired" : false
     }
   } ]
 }

package/src/domain/workflow/registry/model-registry-store.ts

@@ -63,6 +63,19 @@ export const FAST_VARIANT_KEY = "fast";
  */
 export const THINKING_CAPABILITY_KEY = "thinking";
 
+/**
+ * The registry capability key of adaptive thinking, the second form that
+ * makes THINKING_MODE_ENABLED selectable (stigmer/stigmer#1280).
+ */
+export const ADAPTIVE_THINKING_CAPABILITY_KEY = "adaptiveThinking";
+
+/**
+ * The registry capability key naming a model that always thinks and refuses
+ * a request to turn thinking off: an explicit THINKING_MODE_DISABLED is
+ * refused for it at create.
+ */
+export const THINKING_REQUIRED_CAPABILITY_KEY = "thinkingRequired";
+
 export interface ModelRegistryStoreOptions {
   /** Bundled build-time snapshot; MUST pass the sanity gate at boot. */
   bundledDocument: string;
@@ -202,9 +215,9 @@ export class ModelRegistryStore implements ModelCatalogProvider {
    * "thinking") true under the given harness. Capability flags are
    * harness-scoped facts (they describe what works through that serving
    * path), so there is no any-harness form: THINKING_MODE_ENABLED validates
-   * against the cursor harness specifically — the only harness with a
-   * thinking translation in v1 (oss#772) — and native entries declaring the
-   * same capability stay unselectable until a native wire mapping exists.
+   * against the entry of the harness the execution runs on (oss#772,
+   * stigmer/stigmer#1280), because an id with an entry on both harnesses
+   * can declare different capabilities on each.
    */
   hasCapabilityForHarness(
     harness: string,

package/src/pipeline/__tests__/blind-not-found.test.ts

@@ -41,9 +41,6 @@ const PENDING: ReadonlyMap<string, number> = new Map([
   ["domain/agentchannel/controller.ts", 1],
   ["domain/agentinstance/controller.ts", 1],
   ["domain/agentshare/controller.ts", 1],
-  ["domain/artifact/controller.ts", 1],
-  ["domain/environment/controller.ts", 1],
-  ["domain/environment/steps.ts", 1],
   ["domain/plugin/controller.ts", 1],
   ["domain/skill/controller.ts", 1],
   ["domain/workflow/controller.ts", 1],