amalgm 0.1.86 → 0.1.87

package/runtime/scripts/amalgm-mcp/tests/automations-reliability.test.js

@@ -0,0 +1,547 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'amalgm-automations-reliability-test-'));
+process.env.AMALGM_DIR = path.join(tempRoot, '.amalgm');
+
+const { closeLocalDb, openLocalDb } = require('../state/db');
+const {
+  createAutomation,
+  deleteAutomation,
+  expireStaleAutomationRuns,
+  getAutomation,
+  getAutomationRun,
+  listAutomationRuns,
+  pruneAutomationRuns,
+  recordAutomationRun,
+  repairScheduledTriggers,
+  updateAutomation,
+} = require('../automations/store');
+const { executeAutomation } = require('../automations/runner');
+const { handleEventsPost } = require('../events/ingress');
+
+const SIMPLE_WORKFLOW = `export default workflow({
+  trigger: event("*.*"),
+  cells: [code("ok", async () => ({ ok: true }))]
+})`;
+
+function fakeRequest(headers, body) {
+  return {
+    headers,
+    on(event, callback) {
+      if (event === 'data') setImmediate(() => callback(body));
+      if (event === 'end') setImmediate(() => callback());
+    },
+  };
+}
+
+function captureJson() {
+  const result = { status: null, body: null };
+  result.send = (status, body) => {
+    result.status = status;
+    result.body = body;
+  };
+  return result;
+}
+
+test.after(() => {
+  closeLocalDb();
+  fs.rmSync(tempRoot, { recursive: true, force: true });
+});
+
+test('updating the trigger array preserves trigger identity, secret, and schedule clock', () => {
+  const automation = createAutomation({
+    id: 'automation-preserve',
+    name: 'Preserve identity',
+    triggers: [
+      { id: 'trigger-keep-event', kind: 'event', source: 'audit', event: 'ping' },
+      { id: 'trigger-keep-schedule', kind: 'scheduled', schedule: { kind: 'interval', ms: 3_600_000 } },
+    ],
+    workflowText: SIMPLE_WORKFLOW,
+  });
+  const originalEvent = automation.triggers.find((trigger) => trigger.id === 'trigger-keep-event');
+  const originalScheduled = automation.triggers.find((trigger) => trigger.id === 'trigger-keep-schedule');
+  assert.ok(originalEvent.secret);
+  assert.ok(originalScheduled.nextRunAt);
+
+  // Round-trip the trigger array with ids (the UI add-trigger path).
+  const updated = updateAutomation('automation-preserve', {
+    triggers: [
+      { id: 'trigger-keep-event', kind: 'event', source: 'audit', event: 'ping', name: 'Renamed event trigger' },
+      { id: 'trigger-keep-schedule', kind: 'scheduled', schedule: { kind: 'interval', ms: 3_600_000 } },
+      { kind: 'event', source: 'github', event: 'push' },
+    ],
+  });
+  const keptEvent = updated.triggers.find((trigger) => trigger.id === 'trigger-keep-event');
+  const keptScheduled = updated.triggers.find((trigger) => trigger.id === 'trigger-keep-schedule');
+  assert.equal(updated.triggers.length, 3);
+  assert.equal(keptEvent.secret, originalEvent.secret, 'webhook secret must survive trigger-array updates');
+  assert.equal(keptEvent.name, 'Renamed event trigger');
+  assert.equal(keptScheduled.nextRunAt, originalScheduled.nextRunAt, 'interval clock must not reset on update');
+
+  // Without ids, fingerprint matching still preserves identity.
+  const refingerprinted = updateAutomation('automation-preserve', {
+    triggers: [
+      { kind: 'event', source: 'audit', event: 'ping' },
+      { kind: 'scheduled', schedule: { kind: 'interval', ms: 3_600_000 } },
+    ],
+  });
+  assert.equal(refingerprinted.triggers.length, 2);
+  assert.equal(
+    refingerprinted.triggers.find((trigger) => trigger.kind === 'event').secret,
+    originalEvent.secret,
+    'fingerprint-matched event trigger keeps its secret',
+  );
+});
+
+test('editing a schedule recomputes next_run_at immediately', () => {
+  const automation = createAutomation({
+    id: 'automation-reschedule',
+    name: 'Reschedule',
+    triggers: [{ id: 'trigger-reschedule', kind: 'scheduled', schedule: { kind: 'interval', ms: 3_600_000 } }],
+    workflowText: SIMPLE_WORKFLOW,
+  });
+  const before = automation.triggers[0].nextRunAt;
+  assert.ok(before);
+
+  const updated = updateAutomation('automation-reschedule', {
+    trigger: { id: 'trigger-reschedule', schedule: { kind: 'interval', ms: 7_200_000 } },
+  });
+  const after = updated.triggers[0].nextRunAt;
+  assert.ok(after);
+  assert.notEqual(after, before, 'schedule change must re-arm next_run_at');
+  assert.ok(new Date(after) > new Date(before), 'new 2h cadence lands later than old 1h cadence');
+});
+
+test('invalid cron expressions are rejected at save time', () => {
+  assert.throws(() => createAutomation({
+    id: 'automation-bad-cron',
+    name: 'Bad cron',
+    triggers: [{ kind: 'scheduled', schedule: { kind: 'cron', expr: 'not a cron expr' } }],
+    workflowText: SIMPLE_WORKFLOW,
+  }), /cron/i);
+});
+
+test('repairScheduledTriggers re-arms enabled triggers with NULL next_run_at', () => {
+  createAutomation({
+    id: 'automation-dormant',
+    name: 'Dormant trigger',
+    triggers: [{ id: 'trigger-dormant', kind: 'scheduled', schedule: { kind: 'interval', ms: 3_600_000 } }],
+    workflowText: SIMPLE_WORKFLOW,
+  });
+  const db = openLocalDb();
+  db.prepare('UPDATE automation_triggers SET next_run_at = NULL WHERE id = ?').run('trigger-dormant');
+
+  const repaired = repairScheduledTriggers();
+  assert.equal(repaired.some((trigger) => trigger.id === 'trigger-dormant'), true);
+  const trigger = getAutomation('automation-dormant').triggers[0];
+  assert.ok(trigger.nextRunAt, 'dormant trigger must be re-armed');
+});
+
+test('expireStaleAutomationRuns marks stalled running runs as interrupted', () => {
+  createAutomation({
+    id: 'automation-stale-run',
+    name: 'Stale run',
+    triggers: [{ kind: 'event', source: 'stale', event: 'run' }],
+    workflowText: SIMPLE_WORKFLOW,
+  });
+  recordAutomationRun('automation-stale-run', {
+    runId: 'run-stale',
+    status: 'running',
+    startedAt: new Date(Date.now() - 60 * 60_000).toISOString(),
+  });
+  const db = openLocalDb();
+  const staleTimestamp = new Date(Date.now() - 30 * 60_000).toISOString();
+  db.prepare('UPDATE automation_runs SET updated_at = ? WHERE id = ?').run(staleTimestamp, 'run-stale');
+
+  const expired = expireStaleAutomationRuns({ staleAfterMs: 10 * 60_000 });
+  assert.equal(expired.some((run) => run.id === 'run-stale'), true);
+  const run = getAutomationRun('run-stale');
+  assert.equal(run.status, 'interrupted');
+  assert.ok(run.finishedAt);
+
+  // Terminal status is final: a late cell event cannot resurrect the run.
+  recordAutomationRun('automation-stale-run', { runId: 'run-stale', status: 'running' });
+  assert.equal(getAutomationRun('run-stale').status, 'interrupted');
+});
+
+test('pruneAutomationRuns keeps the most recent runs per automation', () => {
+  createAutomation({
+    id: 'automation-prune',
+    name: 'Prune runs',
+    triggers: [{ kind: 'event', source: 'prune', event: 'run' }],
+    workflowText: SIMPLE_WORKFLOW,
+  });
+  for (let index = 0; index < 5; index += 1) {
+    recordAutomationRun('automation-prune', {
+      runId: `run-prune-${index}`,
+      status: 'completed',
+      startedAt: new Date(Date.now() - (10 - index) * 60_000).toISOString(),
+      finishedAt: new Date(Date.now() - (9 - index) * 60_000).toISOString(),
+    });
+  }
+  pruneAutomationRuns({ keepPerAutomation: 2 });
+  const runs = listAutomationRuns({ automationId: 'automation-prune' });
+  assert.equal(runs.length, 2);
+});
+
+test('multiple workflows per automation: each firing records one run per enabled workflow', async () => {
+  const automation = createAutomation({
+    id: 'automation-multi',
+    name: 'Multi workflow',
+    triggers: [{ id: 'trigger-multi', kind: 'event', source: 'multi', event: 'go' }],
+    workflows: [
+      {
+        id: 'wf-multi-a',
+        name: 'First workflow',
+        workflowText: `export default workflow({
+  trigger: event("multi.go"),
+  cells: [code("a", async () => ({ which: "a" }))]
+})`,
+      },
+      {
+        id: 'wf-multi-b',
+        name: 'Second workflow',
+        workflowText: `export default workflow({
+  trigger: event("multi.go"),
+  cells: [code("b", async () => ({ which: "b" }))]
+})`,
+      },
+    ],
+  });
+  assert.equal(automation.workflows.length, 2);
+  assert.deepEqual(automation.workflowIds, ['wf-multi-a', 'wf-multi-b']);
+  assert.equal(automation.workflowId, 'wf-multi-a');
+
+  const runs = await executeAutomation(automation, automation.triggers[0], {
+    source: 'multi', event: 'go', payload: {}, headers: {},
+  });
+  assert.equal(runs.length, 2);
+  assert.deepEqual(runs.map((run) => run.status), ['completed', 'completed']);
+  assert.deepEqual(runs.map((run) => run.workflowId), ['wf-multi-a', 'wf-multi-b']);
+  assert.equal(listAutomationRuns({ automationId: 'automation-multi' }).length, 2);
+
+  // getAutomation round-trips the full workflow set from the link table.
+  const reread = getAutomation('automation-multi');
+  assert.deepEqual(reread.workflowIds, ['wf-multi-a', 'wf-multi-b']);
+
+  // Workflows-array update by id preserves identity and can disable one.
+  const updated = updateAutomation('automation-multi', {
+    workflows: [
+      { id: 'wf-multi-a' },
+      { id: 'wf-multi-b', enabled: false },
+    ],
+  });
+  assert.deepEqual(updated.workflowIds, ['wf-multi-a', 'wf-multi-b']);
+  assert.equal(updated.workflows[1].enabled, false);
+
+  const secondRound = await executeAutomation(updated, updated.triggers[0], {
+    source: 'multi', event: 'go', payload: {}, headers: {},
+  });
+  assert.equal(secondRound.length, 1, 'disabled workflow is skipped');
+  assert.equal(secondRound[0].workflowId, 'wf-multi-a');
+});
+
+test('one failing workflow does not block the others in the same firing', async () => {
+  const automation = createAutomation({
+    id: 'automation-partial-fail',
+    name: 'Partial failure',
+    triggers: [{ kind: 'event', source: 'partial', event: 'go' }],
+    workflows: [
+      `export default workflow({
+  trigger: event("partial.go"),
+  cells: [code("boom", async () => { throw new Error("boom") })]
+})`,
+      `export default workflow({
+  trigger: event("partial.go"),
+  cells: [code("fine", async () => ({ ok: true }))]
+})`,
+    ],
+  });
+
+  const runs = await executeAutomation(automation, automation.triggers[0], {
+    source: 'partial', event: 'go', payload: {}, headers: {},
+  });
+  assert.equal(runs.length, 2);
+  assert.deepEqual(runs.map((run) => run.status).sort(), ['completed', 'failed']);
+});
+
+test('deleting a multi-workflow automation removes its orphaned workflow rows', () => {
+  createAutomation({
+    id: 'automation-delete-multi',
+    name: 'Delete multi',
+    triggers: [{ kind: 'event', source: 'del', event: 'go' }],
+    workflows: [
+      { id: 'wf-del-a', workflowText: SIMPLE_WORKFLOW },
+      { id: 'wf-del-b', workflowText: SIMPLE_WORKFLOW },
+    ],
+  });
+  deleteAutomation('automation-delete-multi');
+  const db = openLocalDb();
+  const remaining = db.prepare(
+    "SELECT COUNT(*) AS count FROM automation_workflows WHERE id IN ('wf-del-a', 'wf-del-b')",
+  ).get();
+  assert.equal(remaining.count, 0);
+  const links = db.prepare(
+    "SELECT COUNT(*) AS count FROM automation_workflow_links WHERE automation_id = 'automation-delete-multi'",
+  ).get();
+  assert.equal(links.count, 0);
+});
+
+test('allowlist action aliases authorize first-party tool calls', async () => {
+  const automation = createAutomation({
+    id: 'automation-alias-allowlist',
+    name: 'Alias allowlist',
+    triggers: [{ kind: 'event', source: 'alias', event: 'go' }],
+    allowlist: { actions: ['amalgm.talk_to_agent'] },
+    limits: { cellTimeoutMs: 1500 },
+    workflowText: `export default workflow({
+  trigger: event("alias.go"),
+  allowlist: { actions: ["amalgm.talk_to_agent"] },
+  limits: { cellTimeoutMs: 1500 },
+  cells: [tool("ask", "agents.talk_to_agent", { description: "test", prompt: "hi", run_in_background: true })]
+})`,
+  });
+  let error = null;
+  try {
+    await executeAutomation(automation, automation.triggers[0], {
+      source: 'alias', event: 'go', payload: {}, headers: {},
+    });
+  } catch (err) {
+    error = err;
+  }
+  // The agent call itself may fail in the test environment (no agent runtime),
+  // but the allowlist gate must accept the amalgm.* alias for agents.talk_to_agent.
+  if (error) {
+    assert.doesNotMatch(error.message || '', /not allowed to call/i);
+  }
+});
+
+test('authenticated-but-unmatched events are recorded as small unmatched runs', async () => {
+  const automation = createAutomation({
+    id: 'automation-unmatched-run',
+    name: 'Unmatched run',
+    triggers: [{ id: 'trigger-unmatched-run', kind: 'event', source: 'audit', event: 'ping' }],
+    workflowText: SIMPLE_WORKFLOW,
+  });
+  const secret = automation.triggers[0].secret;
+
+  const response = captureJson();
+  await handleEventsPost(
+    fakeRequest({ 'x-amalgm-webhook-secret': secret }, JSON.stringify({ source: 'other', event: 'nope' })),
+    response.send,
+  );
+  assert.equal(response.status, 202);
+
+  const runs = listAutomationRuns({ automationId: 'automation-unmatched-run' });
+  assert.equal(runs.length, 1);
+  assert.equal(runs[0].status, 'unmatched');
+  assert.equal(runs[0].triggerId, 'trigger-unmatched-run');
+  assert.equal(runs[0].output.received.source, 'other');
+  assert.equal(runs[0].output.received.event, 'nope');
+  assert.ok(runs[0].finishedAt, 'unmatched runs are terminal');
+});
+
+test('workflows[] cannot reference a workflow id owned by another automation', () => {
+  createAutomation({
+    id: 'automation-owner-a',
+    name: 'Owner A',
+    triggers: [{ kind: 'event', source: 'own', event: 'a' }],
+    workflows: [{ id: 'wf-owned-a', workflowText: SIMPLE_WORKFLOW }],
+  });
+  createAutomation({
+    id: 'automation-owner-b',
+    name: 'Owner B',
+    triggers: [{ kind: 'event', source: 'own', event: 'b' }],
+    workflows: [{ id: 'wf-owned-b', workflowText: SIMPLE_WORKFLOW }],
+  });
+
+  // Update path: foreign id must be rejected, not clobbered.
+  assert.throws(() => updateAutomation('automation-owner-b', {
+    workflows: [{ id: 'wf-owned-a', workflowText: SIMPLE_WORKFLOW }],
+  }), /another automation/);
+
+  // Create path too.
+  assert.throws(() => createAutomation({
+    id: 'automation-owner-c',
+    name: 'Owner C',
+    triggers: [{ kind: 'event', source: 'own', event: 'c' }],
+    workflows: [{ id: 'wf-owned-a', workflowText: SIMPLE_WORKFLOW }],
+  }), /another automation/);
+
+  // Owner A untouched.
+  const ownerA = getAutomation('automation-owner-a');
+  assert.deepEqual(ownerA.workflowIds, ['wf-owned-a']);
+
+  // Duplicate ids in one array are rejected cleanly.
+  assert.throws(() => updateAutomation('automation-owner-b', {
+    workflows: [{ id: 'wf-owned-b' }, { id: 'wf-owned-b' }],
+  }), /Duplicate workflow id/);
+
+  // workflowText alongside workflows is ambiguous — rejected.
+  assert.throws(() => updateAutomation('automation-owner-b', {
+    workflows: [{ id: 'wf-owned-b' }],
+    workflowText: SIMPLE_WORKFLOW,
+  }), /not both/);
+});
+
+test('mixed id/no-id workflows[] update pairs positionless entries with surviving workflows', () => {
+  createAutomation({
+    id: 'automation-mixed',
+    name: 'Mixed update',
+    triggers: [{ kind: 'event', source: 'mixed', event: 'go' }],
+    workflows: [
+      { id: 'wf-mixed-1', workflowText: SIMPLE_WORKFLOW },
+      { id: 'wf-mixed-2', workflowText: SIMPLE_WORKFLOW },
+    ],
+  });
+  // Reorder with one explicit id and one positionless entry: the positionless
+  // entry must bind to the remaining workflow instead of orphan-deleting it.
+  const updated = updateAutomation('automation-mixed', {
+    workflows: [{ id: 'wf-mixed-2' }, { workflowText: SIMPLE_WORKFLOW }],
+  });
+  assert.deepEqual([...updated.workflowIds].sort(), ['wf-mixed-1', 'wf-mixed-2']);
+});
+
+test('top-level allowlist/limits apply to every workflows[] entry', () => {
+  const automation = createAutomation({
+    id: 'automation-allowlist',
+    name: 'Allowlist propagation',
+    triggers: [{ kind: 'event', source: 'al', event: 'go' }],
+    allowlist: { network: true },
+    limits: { cellTimeoutMs: 5000 },
+    workflows: [
+      SIMPLE_WORKFLOW,
+      { workflowText: SIMPLE_WORKFLOW, allowlist: { localCompute: true } },
+    ],
+  });
+  assert.deepEqual(automation.workflows[0].allowlist, { network: true });
+  assert.deepEqual(automation.workflows[0].limits, { cellTimeoutMs: 5000 });
+  // Per-entry allowlist wins over the top-level default.
+  assert.deepEqual(automation.workflows[1].allowlist, { localCompute: true });
+});
+
+test('a real completion overrides a reaper-written interrupted status', () => {
+  createAutomation({
+    id: 'automation-override',
+    name: 'Override interrupted',
+    triggers: [{ kind: 'event', source: 'ovr', event: 'go' }],
+    workflowText: SIMPLE_WORKFLOW,
+  });
+  recordAutomationRun('automation-override', {
+    runId: 'run-override',
+    status: 'running',
+    startedAt: new Date(Date.now() - 30 * 60_000).toISOString(),
+  });
+  const db = openLocalDb();
+  db.prepare('UPDATE automation_runs SET updated_at = ? WHERE id = ?')
+    .run(new Date(Date.now() - 20 * 60_000).toISOString(), 'run-override');
+  expireStaleAutomationRuns({ staleAfterMs: 10 * 60_000 });
+  assert.equal(getAutomationRun('run-override').status, 'interrupted');
+
+  // The cell was actually still running and now finishes legitimately.
+  const finishedAt = new Date().toISOString();
+  recordAutomationRun('automation-override', {
+    runId: 'run-override',
+    status: 'completed',
+    finishedAt,
+  });
+  const run = getAutomationRun('run-override');
+  assert.equal(run.status, 'completed', 'in-process completion wins over reaper interruption');
+  assert.equal(run.finishedAt, finishedAt);
+  assert.equal(run.error, null, 'reaper error message cleared by the real outcome');
+
+  // But interrupted -> running is still rejected.
+  recordAutomationRun('automation-override', { runId: 'run-override', status: 'running' });
+  assert.equal(getAutomationRun('run-override').status, 'completed');
+});
+
+test('repeated unmatched deliveries of the same ref collapse into one run row per day', async () => {
+  const automation = createAutomation({
+    id: 'automation-unmatched-dedupe',
+    name: 'Unmatched dedupe',
+    triggers: [{ id: 'trigger-unmatched-dedupe', kind: 'event', source: 'audit', event: 'ping' }],
+    workflowText: SIMPLE_WORKFLOW,
+  });
+  const secret = automation.triggers[0].secret;
+  for (let i = 0; i < 3; i += 1) {
+    const response = captureJson();
+    await handleEventsPost(
+      fakeRequest({ 'x-amalgm-webhook-secret': secret }, JSON.stringify({ source: 'spam', event: 'ref' })),
+      response.send,
+    );
+    assert.equal(response.status, 202);
+  }
+  const runs = listAutomationRuns({ automationId: 'automation-unmatched-dedupe' })
+    .filter((run) => run.status === 'unmatched');
+  assert.equal(runs.length, 1, 'same unmatched ref must refresh one row, not spam history');
+  assert.ok(runs[0].events.length >= 3, 'each receipt is still logged on the row');
+});
+
+test('incidental body source/event fields fall back to external.webhook for legacy triggers', async () => {
+  const automation = createAutomation({
+    id: 'automation-legacy-generic',
+    name: 'Legacy generic webhook',
+    triggers: [{ id: 'trigger-legacy-generic', kind: 'event', source: 'external', event: 'webhook' }],
+    workflowText: SIMPLE_WORKFLOW,
+  });
+  const secret = automation.triggers[0].secret;
+  // A third-party payload that happens to contain an "event" key must still
+  // fire the trigger pinned to the legacy external.webhook ref.
+  const response = captureJson();
+  await handleEventsPost(
+    fakeRequest(
+      { 'x-amalgm-webhook-secret': secret },
+      JSON.stringify({ event: 'invitee.created', payloadField: 1 }),
+    ),
+    response.send,
+  );
+  assert.equal(response.status, 200);
+  assert.equal(response.body.triggered, true);
+  assert.equal(response.body.event.source, 'external');
+  assert.equal(response.body.event.event, 'webhook');
+});
+
+test('ingress matches body-declared refs for generic signed senders and 202s unmatched events', async () => {
+  const automation = createAutomation({
+    id: 'automation-custom-ref',
+    name: 'Custom ref webhook',
+    triggers: [{ id: 'trigger-custom-ref', kind: 'event', source: 'audit', event: 'ping' }],
+    workflowText: SIMPLE_WORKFLOW,
+  });
+  const secret = automation.triggers[0].secret;
+  assert.ok(secret);
+
+  // Body-declared source/event must reach the trigger selector.
+  const matched = captureJson();
+  await handleEventsPost(
+    fakeRequest({ 'x-amalgm-webhook-secret': secret }, JSON.stringify({ source: 'audit', event: 'ping' })),
+    matched.send,
+  );
+  assert.equal(matched.status, 200);
+  assert.equal(matched.body.triggered, true);
+  assert.equal(matched.body.event.source, 'audit');
+  assert.equal(matched.body.event.event, 'ping');
+
+  // Valid secret + non-matching ref is not an auth failure.
+  const unmatched = captureJson();
+  await handleEventsPost(
+    fakeRequest({ 'x-amalgm-webhook-secret': secret }, JSON.stringify({ source: 'other', event: 'nope' })),
+    unmatched.send,
+  );
+  assert.equal(unmatched.status, 202);
+  assert.equal(unmatched.body.triggered, false);
+
+  // Wrong secret stays a 401.
+  const rejected = captureJson();
+  await handleEventsPost(
+    fakeRequest({ 'x-amalgm-webhook-secret': 'wrong-secret' }, JSON.stringify({ source: 'audit', event: 'ping' })),
+    rejected.send,
+  );
+  assert.equal(rejected.status, 401);
+});

package/runtime/scripts/amalgm-mcp/tests/automations-store-runner.test.js

@@ -83,7 +83,7 @@ test('trigger update changes trigger fields without renaming parent automation',
 test('automation runner records unified run and cell receipts', async () => {
   const automation = buildSnapshot('automations').resources.automations
     .find((item) => item.id === 'automation-webhook');
-  const run = await executeAutomation(automation, automation.triggers[0], {
+  const [run] = await executeAutomation(automation, automation.triggers[0], {
     source: 'github',
     event: 'push',
     payload: { ref: 'refs/heads/main' },
@@ -137,7 +137,7 @@ test('workflow ctx exposes previous cell outputs through cells aliases', async (
 })`,
   });
 
-  const run = await executeAutomation(automation, automation.triggers[0], {
+  const [run] = await executeAutomation(automation, automation.triggers[0], {
     source: 'test',
     event: 'cells',
     payload: {},
@@ -262,7 +262,7 @@ test('dotted toolbox action refs validate and run after the action is registered
     triggers: [{ id: 'trigger-dotted-toolbox', kind: 'event', source: 'test', event: 'quote' }],
     workflowText,
   });
-  const run = await executeAutomation(automation, automation.triggers[0], {
+  const [run] = await executeAutomation(automation, automation.triggers[0], {
     source: 'test',
     event: 'quote',
     payload: {},

package/runtime/scripts/chat-core/contract.js

@@ -32,9 +32,12 @@ function canonicalModel(modelId, harness) {
       'opus': 'anthropic/claude-opus-4.8',
       'opus1m': 'anthropic/claude-opus-4.8-1m',
       'opus[1m]': 'anthropic/claude-opus-4.8-1m',
+      'fable': 'anthropic/claude-fable-5',
       'claude-code-haiku': 'anthropic/claude-haiku-4.5',
       'claude-code-sonnet': 'anthropic/claude-sonnet-4.6',
       'claude-code-sonnet-45': 'anthropic/claude-sonnet-4.6',
+      'claude-code-fable': 'anthropic/claude-fable-5',
+      'claude-code-fable-5': 'anthropic/claude-fable-5',
       'claude-code-opus': 'anthropic/claude-opus-4.8',
       'claude-code-opus-45': 'anthropic/claude-opus-4.8',
       'claude-code-opus-46': 'anthropic/claude-opus-4.8',
@@ -61,6 +64,7 @@ function canonicalModel(modelId, harness) {
       'claude-code-haiku-4.5': 'anthropic/claude-haiku-4.5',
       'claude-code-haiku-4-5': 'anthropic/claude-haiku-4.5',
       'claude-haiku-4-5': 'anthropic/claude-haiku-4.5',
+      'claude-fable-5': 'anthropic/claude-fable-5',
       'claude-sonnet-4-5': 'anthropic/claude-sonnet-4.6',
       'claude-sonnet-4-6': 'anthropic/claude-sonnet-4.6',
       'claude-opus-4-5': 'anthropic/claude-opus-4.8',
@@ -73,6 +77,7 @@ function canonicalModel(modelId, harness) {
       'claude-opus-4.7-1m': 'anthropic/claude-opus-4.8-1m',
       'anthropic/claude-haiku-4-5': 'anthropic/claude-haiku-4.5',
       'anthropic/claude-haiku-4.5': 'anthropic/claude-haiku-4.5',
+      'anthropic/claude-fable-5': 'anthropic/claude-fable-5',
       'anthropic/claude-sonnet-4-5': 'anthropic/claude-sonnet-4.6',
       'anthropic/claude-sonnet-4-6': 'anthropic/claude-sonnet-4.6',
       'anthropic/claude-sonnet-4.5': 'anthropic/claude-sonnet-4.6',
@@ -115,11 +120,16 @@ function cliModelFor({ harness, modelId, cliModel, reasoningEffort }) {
       'anthropic/claude-opus-4.8-1m': 'opus[1m]',
       'anthropic/claude-opus-4.7': 'opus',
       'anthropic/claude-opus-4.7-1m': 'opus[1m]',
+      'anthropic/claude-fable-5': 'claude-fable-5',
       'haiku': 'haiku',
       'sonnet': 'sonnet',
       'opus': 'opus',
       'opus1m': 'opus[1m]',
       'opus[1m]': 'opus[1m]',
+      'fable': 'claude-fable-5',
+      'claude-code-fable': 'claude-fable-5',
+      'claude-code-fable-5': 'claude-fable-5',
+      'claude-fable-5': 'claude-fable-5',
     };
     return aliases[canonical] || aliases[clean.toLowerCase()] || clean;
   }

package/runtime/scripts/chat-server/model-catalog.js

@@ -37,10 +37,11 @@ const MODEL_CATALOG = [
   { id: "amazon/nova-lite", name: "Nova Lite", provider: "amazon", contextWindow: 300000, maxOutput: 8192, inputPrice: 0.06, outputPrice: 0.24, cacheRead: null, cacheWrite: null, tags: [], released: "2024-12-03" },
   { id: "amazon/nova-micro", name: "Nova Micro", provider: "amazon", contextWindow: 128000, maxOutput: 8192, inputPrice: 0.035, outputPrice: 0.14, cacheRead: null, cacheWrite: null, tags: [], released: null },
   { id: "amazon/nova-pro", name: "Nova Pro", provider: "amazon", contextWindow: 300000, maxOutput: 8192, inputPrice: 0.8, outputPrice: 3.2, cacheRead: null, cacheWrite: null, tags: [], released: "2024-12-03" },
-  // ── anthropic (14) ─────────────────────────────────────────
+  // ── anthropic (17) ─────────────────────────────────────────
   { id: "anthropic/claude-3-haiku", name: "Claude 3 Haiku", provider: "anthropic", contextWindow: 200000, maxOutput: 4096, inputPrice: 0.25, outputPrice: 1.25, cacheRead: 0.03, cacheWrite: 0.3, tags: ["tool-use", "vision", "explicit-caching"], released: "2023-03-01" },
   { id: "anthropic/claude-3.5-haiku", name: "Claude 3.5 Haiku", provider: "anthropic", contextWindow: 200000, maxOutput: 8192, inputPrice: 0.8, outputPrice: 4, cacheRead: 0.08, cacheWrite: 1, tags: ["file-input", "tool-use", "vision", "explicit-caching"], released: "2023-11-06" },
   { id: "anthropic/claude-3.7-sonnet", name: "Claude 3.7 Sonnet", provider: "anthropic", contextWindow: 200000, maxOutput: 8192, inputPrice: 3, outputPrice: 15, cacheRead: 0.3, cacheWrite: 3.75, tags: ["file-input", "reasoning", "tool-use", "vision", "explicit-caching"], released: "2024-01-25" },
+  { id: "anthropic/claude-fable-5", name: "Claude Fable 5", provider: "anthropic", contextWindow: 1000000, maxOutput: 128000, inputPrice: 10, outputPrice: 50, cacheRead: 1, cacheWrite: 12.5, tags: ["tool-use", "reasoning", "vision", "file-input", "explicit-caching", "web-search"], released: null },
   { id: "anthropic/claude-haiku-4.5", name: "Claude Haiku 4.5", provider: "anthropic", contextWindow: 200000, maxOutput: 64000, inputPrice: 1, outputPrice: 5, cacheRead: 0.1, cacheWrite: 1.25, tags: ["file-input", "reasoning", "tool-use", "vision", "explicit-caching"], released: "2025-10-15" },
   { id: "anthropic/claude-opus-4", name: "Claude Opus 4", provider: "anthropic", contextWindow: 200000, maxOutput: 32000, inputPrice: 15, outputPrice: 75, cacheRead: 1.5, cacheWrite: 18.75, tags: ["file-input", "reasoning", "tool-use", "vision", "explicit-caching"], released: "2025-08-05" },
   { id: "anthropic/claude-opus-4.1", name: "Claude Opus 4.1", provider: "anthropic", contextWindow: 200000, maxOutput: 32000, inputPrice: 15, outputPrice: 75, cacheRead: 1.5, cacheWrite: 18.75, tags: ["file-input", "reasoning", "tool-use", "vision", "explicit-caching"], released: "2025-05-22" },