bpmnlint-plugin-camunda-compat 2.60.0 → 2.60.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bpmnlint-plugin-camunda-compat",
-  "version": "2.60.0",
+  "version": "2.60.2",
   "description": "A bpmnlint plug-in for Camunda compatibility",
   "main": "index.js",
   "scripts": {

package/rules/camunda-cloud/agent-tool-output-key.js

@@ -15,10 +15,11 @@ const { annotateRule } = require('../helper');
  * or a part like `toolCallResult.statusCode`), a script task or called decision
  * `resultVariable`, or a connector `resultVariable`/`resultExpression` header.
  *
- * When the tool flow writes result-shaped variables but none of them is
- * `toolCallResult`, every miswrite is reported individually on the element
- * that wrote it (misdirection or wrong casing), so each offending output row
- * carries its own finding. When the flow writes none at all, the rule reports
+ * A wrong-casing near-miss (`toolcallresult`, `TOOLCALLRESULT`, ...) is always
+ * reported on the element that wrote it, even when a sibling write already
+ * sets `toolCallResult` correctly — case-sensitive engines never read it.
+ * Other miswrites are reported individually per row only while no valid
+ * `toolCallResult` exists. When the flow writes none at all, the rule reports
  * once on the entry activity, since there's no single offending element to
  * point to (the agent gets no completion signal and may retry or hallucinate
  * an outcome). Results written from arbitrary FEEL expressions are not
@@ -70,6 +71,19 @@ module.exports = skipInNonExecutableProcess(function(config = {}) {
       return;
     }
 
+    // Miscased near-misses are reported even when a sibling already sets
+    // toolCallResult correctly. Casing variants never satisfy
+    // isToolCallResultChannel, so the overwrite check below ignores them.
+    for (const channel of channels) {
+      if (isToolCallResultCasingMismatch(channel)) {
+        reportErrors(channel.element, reporter, {
+          message: `Wrong casing "${getCasingMismatchText(channel)}": use toolCallResult (case-sensitive).`,
+          data: { type: ERROR_TYPES.AGENT_TOOL_OUTPUT_KEY_CASING_INVALID },
+          path: getChannelPath(channel),
+        });
+      }
+    }
+
     // toolCallResult is set somewhere, but assigning it more than once
     // overwrites the earlier value. Part contributions (toolCallResult.part)
     // and the context put(toolCallResult, ...) accumulation pattern are
@@ -267,7 +281,7 @@ function isToolCallResultChannel({ kind, value }) {
 // case-insensitive name matching for fromAi().
 function isToolCallResultCasingMismatch({ kind, value }) {
   if (kind === 'resultExpression') {
-    return /\btoolcallresult\b/i.test(value) && !/\btoolCallResult\b/.test(value);
+    return !!getResultExpressionCasingMismatch(value);
   }
 
   const lower = value.toLowerCase();
@@ -276,13 +290,21 @@ function isToolCallResultCasingMismatch({ kind, value }) {
   return isCasingVariant && !isToolCallResultChannel({ kind, value });
 }
 
+// The first miscased toolCallResult token in a FEEL expression, or null when
+// every occurrence is cased correctly. Tokens are judged individually, so a
+// correct occurrence never excuses a miscased sibling in the same expression.
+function getResultExpressionCasingMismatch(value) {
+  const tokens = value.match(/\btoolcallresult\b/gi) || [];
+
+  return tokens.find(token => token !== 'toolCallResult') || null;
+}
+
 // The mismatched word itself, not the whole expression, for resultExpression
 // channels (a connector header value is a full FEEL expression, e.g.
 // `={toolcallresult: response.body}`).
 function getCasingMismatchText({ kind, value }) {
   if (kind === 'resultExpression') {
-    const match = value.match(/\btoolcallresult\b/i);
-    return match ? match[0] : value;
+    return getResultExpressionCasingMismatch(value) || value;
   }
 
   return value;

package/rules/camunda-cloud/secrets.js

@@ -15,7 +15,13 @@ const { reportErrors } = require('../utils/reporter');
 
 const { skipInNonExecutableProcess } = require('../utils/rule');
 
-module.exports = skipInNonExecutableProcess(function() {
+const { greaterOrEqual } = require('../utils/version');
+
+// `camunda.secrets.<name>` only resolves on engines with this version or newer;
+// before that, `{{secrets.<name>}}` remains the only working format
+const CAMUNDA_SECRETS_FORMAT_ALLOWED_VERSION = '8.10';
+
+module.exports = skipInNonExecutableProcess(function({ version }) {
   function check(node, reporter) {
     const errors = [
       validateIoMapping,
@@ -33,66 +39,85 @@ module.exports = skipInNonExecutableProcess(function() {
     }
   }
 
-  return {
-    check
-  };
-});
+  function validateIoMapping(node) {
+    const ioMapping = findExtensionElement(node, 'zeebe:IoMapping');
 
-function validateIoMapping(node) {
-  const ioMapping = findExtensionElement(node, 'zeebe:IoMapping');
+    if (!ioMapping) {
+      return [];
+    }
 
-  if (!ioMapping) {
-    return [];
+    return ioMapping.get('inputParameters')
+      .filter(inputParameter => !isValidSecret(inputParameter.get('source')))
+      .map(inputParameter => getReport('source', inputParameter, node));
   }
 
-  return ioMapping.get('inputParameters')
-    .filter(inputParameter => !isValidSecret(inputParameter.get('source')))
-    .map(inputParameter => getReport('source', inputParameter, node));
-}
+  function validateProperties(node) {
+    const properties = findExtensionElement(node, 'zeebe:Properties');
 
-function validateProperties(node) {
-  const properties = findExtensionElement(node, 'zeebe:Properties');
+    if (!properties) {
+      return [];
+    }
 
-  if (!properties) {
-    return [];
+    return (properties.get('properties'))
+      .filter(property => !isValidSecret(property.get('value')))
+      .map(property => getReport('value', property, node));
   }
 
-  return (properties.get('properties'))
-    .filter(property => !isValidSecret(property.get('value')))
-    .map(property => getReport('value', property, node));
-}
+  function validateSubscription(node) {
+    let message;
 
-function validateSubscription(node) {
-  let message;
+    if (is(node, 'bpmn:ReceiveTask')) {
+      message = node.get('messageRef');
+    } else {
+      const messageEventDefinition = getEventDefinition(node, 'bpmn:MessageEventDefinition');
 
-  if (is(node, 'bpmn:ReceiveTask')) {
-    message = node.get('messageRef');
-  } else {
-    const messageEventDefinition = getEventDefinition(node, 'bpmn:MessageEventDefinition');
+      if (!messageEventDefinition) {
+        return [];
+      }
 
-    if (!messageEventDefinition) {
+      message = messageEventDefinition.get('messageRef');
+    }
+
+    if (!message) {
       return [];
     }
 
-    message = messageEventDefinition.get('messageRef');
-  }
+    const subscription = findExtensionElement(message, 'zeebe:Subscription');
 
-  if (!message) {
-    return [];
-  }
+    if (!subscription) {
+      return [];
+    }
 
-  const subscription = findExtensionElement(message, 'zeebe:Subscription');
+    const correlationKey = subscription.get('correlationKey');
 
-  if (!subscription) {
-    return [];
+    return isValidSecret(correlationKey)
+      ? []
+      : [ getReport('correlationKey', subscription, node) ];
   }
 
-  const correlationKey = subscription.get('correlationKey');
+  function isValidSecret(value) {
+    if (!value || !isString(value) || !value.includes('secrets.')) {
+      return true;
+    }
 
-  return isValidSecret(correlationKey)
-    ? []
-    : [ getReport('correlationKey', subscription, node) ];
-}
+    // the current, opt-in `camunda.secrets.<name>` format is always accepted
+    if (/camunda\.secrets\.[\w-]+/.test(value)) {
+      return true;
+    }
+
+    // once the engine supports `camunda.secrets.<name>`, any remaining
+    // `secrets.<name>` reference (wrapped or not) is considered outdated
+    if (greaterOrEqual(version, CAMUNDA_SECRETS_FORMAT_ALLOWED_VERSION)) {
+      return false;
+    }
+
+    return /{{\s*secrets\.[\w-]+\s*}}/.test(value);
+  }
+
+  return {
+    check
+  };
+});
 
 function getReport(propertyName, node, parentNode) {
   const path = getPath(node, parentNode);
@@ -104,14 +129,8 @@ function getReport(propertyName, node, parentNode) {
       type: ERROR_TYPES.SECRET_EXPRESSION_FORMAT_DEPRECATED,
       node,
       parentNode: parentNode,
-      property: propertyName
+      property: propertyName,
+      allowedVersion: CAMUNDA_SECRETS_FORMAT_ALLOWED_VERSION
     }
   };
 }
-
-function isValidSecret(value) {
-  return !value
-    || !isString(value)
-    || !value.includes('secrets.')
-    || /{{\s*secrets\.[\w-]+\s*}}/.test(value);
-}