Commit Graph

1161 Commits

Author SHA1 Message Date
github-actions[bot] 7e7d7e61d2 Version Packages (beta) (#2147) workflow@5.0.0-beta.9 2026-05-29 19:59:27 +02:00
Peter Wielander 409b1033d9 Allow setting workflow attributes from steps (#2157) 2026-05-29 19:38:10 +02:00
Mitul Shah b33c5ef120 Better search handling on the trace viewer (#2144)
* Update copyable-data-block.tsx

* Update event-list.tsx

* Create clever-spans-search.md

* Update index.ts

* Update detail-panel.tsx

* Create icon-button.tsx

* nice

* nice

* cleanup
2026-05-29 16:20:23 +00:00
Peter Wielander d7f7c69719 [docs] Document experimental attributes feature (#2141) 2026-05-29 11:10:00 +00:00
Pranay Prakash 4b5f017635 fix: stabilize abort signal E2E cancellation paths (#2150)
* fix: stabilize abort signal e2e cancellation paths

* fix(core): tolerate duplicate durable abort receipts
2026-05-29 01:29:32 +00:00
Pranay Prakash ae37315cb7 Handle failed stream writes without unhandled rejections (#2142) 2026-05-28 23:33:07 +00:00
Mitul Shah e8e52925ad fix(web-shared): match Geist Button hover, focus, and radius (#2143)
The shared Button's dark-mode hover relied on an unregistered `dark-theme:`
Tailwind variant, so the inverted (default) button lost its hover style — and
the background resolved to transparent when consumed by apps that supply their
own Geist tokens (e.g. vercel/front). Use Geist's literal hover fallbacks
driven by arbitrary ancestor-theme variants instead, render the previously
missing focus-visible ring, and apply Geist's 4px tiny radius to the xs size.
Authored to compile under both Tailwind v3 and v4.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-28 23:24:17 +00:00
Pranay Prakash 65336df9f8 [world-local] Reduce stream metadata I/O (#2139)
* [world-local] Reduce stream metadata I/O

* [world-local] Address stream metadata review feedback
2026-05-28 16:07:20 -07:00
Mitul Shah 799cc09df3 Update zoom factor on the trace viewer timeline (#2041)
* Update trace-viewer.tsx

* Create early-cooks-accept.md

Signed-off-by: Mitul Shah <mitulxshah@gmail.com>

---------

Signed-off-by: Mitul Shah <mitulxshah@gmail.com>
2026-05-28 23:04:38 +00:00
github-actions[bot] 2f19552035 Version Packages (beta) (#2140)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
workflow@5.0.0-beta.8
2026-05-28 11:19:23 -07:00
Peter Wielander 1e6b1fdea2 Attributes MVP (experimental and write-only) and CI hardening (#2134)
* fix(core): scan inline sourcemaps during error remapping

* Attributes MVP (experimental and write-only) (#2088)
2026-05-28 18:06:46 +00:00
Rihan Arfan 55e17656ba fix(builders): exclude .nitro/ from input file discovery (#2109) 2026-05-28 08:58:26 +00:00
adamiBs 62ec5372fb fix(world): make run.input and step.input optional on snapshot schemas (#1979)
The World service omits input fields from run/step snapshot responses when
payloads are externalized as RemoteRef blobs. Mirrors existing
WorkflowRunWithoutData / StepWithoutData types and extends #1939's treatment
of output/error/completedAt to input.

Fixes WorkflowWorldError schema validation failures on every event
acknowledgement after the 2026-05-12 service-side RemoteRef rollout.

Fixes #1977.

Signed-off-by: Nathan Rajlich <n@n8.io>
Co-authored-by: Nathan Rajlich <n@n8.io>
2026-05-27 23:54:32 -07:00
Nathan Rajlich 234412a9d7 [core] Add Promise.race([sleep, hook]) prefix determinism tests (#2125)
Translates the diagrammed pattern into 5 prefix-replay tests that run the
same workflow against progressively longer prefixes of a 5-event log
(hook_created, wait_created, hook_received A, wait_completed,
hook_received B). Each test asserts the consumer takes the same
deterministic path: suspending at the right intermediate point with the
right invocationsQueue state, or completing with race winners
[hookA, sleep]. The full-log test verifies that the trailing
hook_received B is consumed by the dangling race-2 hook awaiter without
producing an unconsumed-event error. Runs in both sync and async
deserialization modes via the existing defineTests harness.
2026-05-27 22:18:08 +00:00
Nathan Rajlich b0d0561afc [world-vercel] Add /run-id sub-export with tagged ULID encode/decode (#1978)
* [world-vercel] Add /run-id sub-export with tagged ULID encode/decode

Encodes a tag bit, 5-bit version, and 6-bit Vercel region ID into a
ULID-shaped string used for workflow run IDs. Tagged values remain
valid 26-char Crockford-Base32 ULIDs so they still sort and round-trip
through any system that accepts ULIDs.

* [world-vercel] Add string-value assertions to run-id tests

Add exact-string expectations for encoded outputs at known inputs,
covering the default region/version pair, numeric region IDs, version
overrides, boundary values (all-zero, all-max), the dirty-input
overwrite case, and the lexicographic-order checks. Also adds an
explicit byte-array expectation for the canonical ULID-spec example
string and an additional first-char-range coverage test for isTagged.

* [world-vercel] Remove internal-repo reference from regions doc comment

* [world-vercel] Address PR review feedback on run-id sub-export

- isTaggedString now fully validates the input as a 26-char Crockford
  Base32 ULID (delegating to ulidToBytes) instead of only inspecting
  the first character. This fixes false positives on inputs like
  '4UUUU...' that have a valid tag-bit position but invalid chars
  later in the string.
- isTagged() now accepts `unknown` to match its documented behavior
  of safely rejecting non-string inputs without requiring callers to
  cast.
- Introduce `RegionKey` for the full set of keys including 'unknown',
  and narrow `RegionCode` to `Exclude<RegionKey, 'unknown'>` so the
  return type of `lookupRegion` and the `DecodedRunId.region` field
  accurately reflect that 'unknown' is never produced. Updates
  `encode` to reject 'unknown' as a region code string at runtime
  (callers wanting the unknown sentinel should pass numeric 0).

* [world-vercel] Move tagged-ULID metadata to the top of randomness

Address review feedback on #1978:

1. **Metadata at top of randomness, not bottom.** Place `regionId` (6
   bits) in the high bits of byte[6] and `version` (5 bits) straddling
   bytes 6 and 7, leaving the bottom 69 bits of randomness untouched by
   `encode`. This means a `monotonicFactory()`-style ULID generator's
   intra-millisecond bottom-bit increments survive encoding intact, so
   consecutive `encode(ulid(), region, { version })` calls with the
   same metadata produce strictly increasing strings. Previously the
   metadata sat in the bottom 11 bits — exactly the bits the monotonic
   factory uses — causing same-ms collisions/inversions.

2. **DecodedRunId is now a discriminated union.** When `tagged: false`,
   the `regionId`, `version`, and `region` fields are typed as
   `null` instead of being populated with garbage bits from arbitrary
   ULIDs. This forces callers to discriminate on `tagged` before
   reading metadata.

3. **regionIdFor: keep runtime backstop, mark as ignored for coverage.**
   The unreachable-in-TS branch stays as a defensive runtime check for
   callers crossing a JS/TS boundary; an istanbul/c8 ignore comment
   keeps coverage tools quiet.

Doc strings and tests updated accordingly. The new layout adds a test
verifying that a sequence of incrementing-bottom-bit ULIDs (simulating
`monotonicFactory()`) round-trips through `encode` as a strictly
increasing sequence.

108/108 world-vercel tests pass; typecheck clean.
2026-05-26 18:08:58 +00:00
Mitul Shah 8633ebb9b3 fix(web-shared): make encrypted-data blur backwards compatible with Tailwind v3 (#2108)
* fix(web-shared): use inline blur style for tailwind v3 compatibility

Co-authored-by: Mitul Shah <mitulxshah@gmail.com>

* fix(web-shared): use blur-[4px] arbitrary value for tailwind v3/v4 compat

Co-authored-by: Mitul Shah <mitulxshah@gmail.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
2026-05-26 17:04:19 +00:00
Karthik Kalyan c58cae6612 [Docs] Cookbook update for child workflows pattern (#2100)
* docs(cookbook): replace child workflow polling with hook resume pattern

Recommend startAndWait() with withChildCompletionHook() for v4 and v5 child
workflow orchestration instead of getRun().status polling loops.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Fix child-workflows cookbook review feedback

Tighten resumeParentCompletion to a discriminated union so hook.resume
typechecks, add zod to the vitest workbench, remove unused resumeHook
import, and add an empty changeset per AGENTS.md.

Co-authored-by: Cursor <cursoragent@cursor.com>

* docs(cookbook): trim child-workflows hook resume guide

Remove redundant polling comparison copy, the getRun() alternative section, and v5-only start() tips to keep the cookbook focused on the hook pattern.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-25 16:02:19 -07:00
Karthik Kalyan ff167d005d [Docs] Fix cookbook pattern for AI SDK (#2099)
* Fix cookbook pattern for AI SDK

The AI SDK cookbook entry presented `streamText` inside a `"use step"`
turn function with tools also marked `"use step"`. That implies tools
are individually durable, but the `"use step"` directive is a no-op
when called from another step — so tools run as plain inline functions
inside `runTurn`, and the durability boundary is the entire turn.

Changes:

- Remove the `"use step"` directive from tool implementations in the
  workflow code sample and add an explanatory comment.
- Update the frontmatter summary and intro paragraph to drop the
  inaccurate "tools remain durable steps" claim.
- Add a "Tools are not individually durable" entry to Pitfalls with
  consequences and mitigations (idempotency or `DurableAgent`).
- Add a `runTurn` durability-boundary bullet to "How it works".
- Add a "Tool call durability" row to the `streamText` vs `DurableAgent`
  comparison table.
- Fix two misleading Key APIs bullets that claimed tools wrap
  `"use step"` functions and that `"use step"` makes tool executions
  durable.

Applied identically to both v4 and v5 cookbook entries.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Apply suggestion from @VaguelySerious

Co-authored-by: Peter Wielander <mittgfu@gmail.com>
Signed-off-by: Karthik Kalyan <105607645+karthikscale3@users.noreply.github.com>

* Correct outdated DurableAgent guidance in AI SDK cookbook.

The callout and comparison table incorrectly claimed DurableAgent lacks stopWhen, structured output, and onStepFinish — update them to reflect the actual implementation and clarify when raw streamText() is still appropriate.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Reword tool comment to describe current behavior, not a changelog.

Address review feedback: the inline comment should explain how tools run inside runTurn without referencing removed "use step" directives.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Signed-off-by: Karthik Kalyan <105607645+karthikscale3@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Peter Wielander <mittgfu@gmail.com>
2026-05-25 11:15:36 -07:00
Nathan Rajlich 503a929d34 build: use inline sourcemaps across all workspace packages (#1799)
* fix(build): use inline sourcemaps across all workspace packages

Prevents a Turbopack bug on Windows that caused the SWC worker to
crash when reading external .js.map files in workspace-linked packages
(paths were concatenated with mixed separators like
'packages/serde/dist\\index.js.map'). Once the worker crashed, the
module graph entered a broken state where all subsequent requests
returned 500, manifesting as flaky E2E Windows tests where the
'should rebuild on imported step dependency change' test would time
out waiting for /api/workflows/start to succeed.

Extends the original fix from #352 (previously applied only to
@workflow/core and workflow) to the shared base tsconfig.json so that
all packages producing a dist/ output benefit.

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Nathan Rajlich <n@n8.io>

* Tighten changeset description

---------

Signed-off-by: Nathan Rajlich <n@n8.io>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-05-23 08:36:30 +00:00
Peter Wielander 2050656099 [core] Memoize getWritable() to fix chunk reordering when called repeatedly (#2086) 2026-05-23 09:52:22 +02:00
Nathan Rajlich 657e8bb962 Forward-port #1920: tighten world-local ID validation (#2097)
* fix(world-local): tighten ID validation

Forward-port of code review fixes from #1920 (backport of #1829):

- Reject dots inside entity IDs in `assertSafeEntityId`. Internal IDs
  (ULIDs, step_N, etc.) never contain dots, but `stripTag()` /
  `getObjectCreatedAt()` strip a trailing `.[tag]` suffix from filenames,
  so a request-supplied runId like `wrun_123.foo` would be silently
  mangled during listing/pagination.

- Reject empty `correlationId` on events that include one. The event
  schemas only require `z.string()`, so without this check a
  step_created / hook_created / wait_created request with
  `correlationId: ''` would silently be written under a malformed
  composite key like `${runId}-`.

The streamer regression tests from #1920 are not forward-ported because
main's streamer surface differs (renamed methods, separate test
coverage) from stable's v4 shape.

* simplify changeset
2026-05-22 13:49:41 -07:00
Nathan Rajlich c597ad999d fix(workbench): cache .vercel/output for Next workbench builds (#2095)
Turborepo replays nextjs-turbopack:build from cache without restoring the
Vercel diagnostics manifest (.vercel/output/diagnostics/workflows-manifest.json),
which causes the Vercel deployment to fail post-build. Add .vercel/output/**
to the workbench's Turbo outputs so it is persisted and replayed. Applies to
both nextjs-turbopack and nextjs-webpack (whose turbo.json is a symlink).
2026-05-22 12:53:10 -07:00
Nathan Rajlich 250ff57b3f [ci] Attribute backport changelog entries to original PR author (#2091)
* [ci] Attribute backport changelog entries to original PR author

`@changesets/changelog-github` resolves a changeset commit to its
associated PR via the GitHub GraphQL `associatedPullRequests` field. For
commits landed on `stable` via our backport workflow, that resolves to
the backport PR authored by `github-actions[bot]` (since the backport
workflow uses `createCommitOnBranch` to produce signed commits), so the
generated changelog ends up with "Thanks @github-actions!" instead of
the original contributor.

This adds a small `.changeset/changelog.mjs` wrapper around
`@changesets/changelog-github` that detects backport PRs by matching the
title (`Backport #N: ...`) or body (`Automated backport of #N to
` + '`stable`' + `...`) produced by `.github/workflows/backport.yml`, resolves the
original PR number, and injects `pr:`/`commit:` directives into the
changeset summary before delegating to the upstream generator. The
result is that the rendered changelog entry attributes the change to the
original PR and author, while the commit link still points at the
backport commit on the release branch.

* Address review feedback

- Use `Bearer` instead of `Token` for the GitHub GraphQL auth header
  for consistency with the rest of the repo (Copilot review on PR #2091).
- Add a defensive `formatError` helper so `console.warn` in the catch
  blocks doesn't itself throw when a non-Error value is thrown (Copilot
  review on PR #2091).
2026-05-22 11:02:42 -07:00
Peter Wielander a490f584e0 [web-shared] Fix "Queued for" duration for retried steps (#2087) 2026-05-22 18:51:59 +02:00
Mitul Shah 34481af4b6 Detail Pane Cleanup (#1973)
* cleanup items

* Update events-list.tsx

* nice

* Update attribute-panel.tsx

* woo

* remove toast

* Fix: Unused variable `selectedResource` causes TypeScript build failure (TS6133) due to `noUnusedLocals: true` in tsconfig.

This commit fixes the issue reported at packages/web-shared/src/components/new-trace-viewer/trace-viewer.tsx:462

**Bug explanation:**

The variable `selectedResource` is declared on line 462 of `trace-viewer.tsx`:

```ts
const selectedResource = selectedSpan?.resource as string | undefined;
```

However, all references to this variable were removed in the PR (the colored resource badge in the panel header was removed), leaving behind the unused declaration. The project's TypeScript configuration has `noUnusedLocals: true`, which causes TypeScript to emit error TS6133 for any declared-but-unused local variables. This is confirmed directly in the Vercel build logs:

```
@workflow/web-shared:build: src/components/new-trace-viewer/trace-viewer.tsx(462,9): error TS6133: 'selectedResource' is declared but its value is never read.
```

This caused the `@workflow/web-shared#build` task to fail with exit code 2, which in turn caused the entire Vercel deployment to fail.

**Fix explanation:**

Removed the unused `const selectedResource = selectedSpan?.resource as string | undefined;` declaration on line 462. The nearby `selectedResourceId` variable (which was NOT removed) remains in place and is still actively used in the JSX below. This is a minimal one-line deletion that resolves the build failure.

Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
Co-authored-by: mitul-s <mitulxshah@gmail.com>

* tweak

* Update events-list.tsx

* Update events-list.tsx

* cleanup

* Update attribute-panel.tsx

* copy button

* Create button.tsx

* cleanup

* rename `this` to Context

* cleanup

* Update button.tsx

* avoid decrypt flashign

* cleanup

* Update attribute-panel.tsx

* nav on detail card

* polish

* Update detail-card.tsx

* Update trace-viewer.tsx

* colors

* Update attribute-panel.tsx

* Update detail-card.tsx

* Update copyable-data-block.tsx

* Detail Pane + Other cleanup items (#2020)

* polish

* Update attribute-panel.tsx

* Create wise-frogs-thank.md

Signed-off-by: Mitul Shah <mitulxshah@gmail.com>

---------

Signed-off-by: Mitul Shah <mitulxshah@gmail.com>

---------

Signed-off-by: Mitul Shah <mitulxshah@gmail.com>
Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
2026-05-22 15:30:38 +00:00
Nathan Rajlich 070bd0cea9 [next] make lazyDiscovery the default in withWorkflow (#1805)
* [next] make lazyDiscovery the default in withWorkflow

Flips the default for `workflows.lazyDiscovery` from `false` to `true`
so new projects get deferred workflow discovery automatically on Next.js
versions that support deferred entries (>= 16.2.0-canary.48). Older
versions continue to fall back to eager discovery.

Users can still opt back into eager discovery explicitly by passing
`workflows: { lazyDiscovery: false }`.

Also:
- Remove the now-redundant `lazyDiscovery: true` from the Next.js
  workbench apps.
- Reword the fallback warning for clarity when lazy is the default.
- Update the local-build e2e assertion to match the new warning text.
- Update the withWorkflow docs with the new default.

* [workbench] remove commented 'export default nextConfig' lines
2026-05-22 14:11:34 +00:00
Rich Haines cf256b56f1 [docs] Replace local ai-agent-detection with @vercel/agent-readability (#1580) 2026-05-22 13:43:43 +00:00
Karthik Kalyan c5023646d1 [docs] Add cookbook entry on upgrading workflows (#1874)
Co-authored-by: Peter Wielander <mittgfu@gmail.com>
2026-05-22 13:35:09 +00:00
Pranay Prakash 0d0bb013d7 Generate local gitignore when using public workflow manifests (#1683)
Co-authored-by: Peter Wielander <peter.wielander@vercel.com>
Co-authored-by: Peter Wielander <mittgfu@gmail.com>
2026-05-22 15:22:25 +02:00
Peter Wielander 76d786efa1 [tests] Fix abort-fetch e2e flake (#2081) 2026-05-22 13:35:05 +02:00
github-actions[bot] 8f9656deab Version Packages (beta) (#2026)
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
workflow@5.0.0-beta.7
2026-05-22 09:34:43 +02:00
Peter Wielander 9454151b0e [core] Fix "event cursor missing after initial load" performance degradation due to clobbered cursor (#2056) 2026-05-22 09:12:21 +02:00
Nathan Rajlich 2a446af517 [core] Exclude inline step execution from replay timeout (#2013)
* [core] Exclude inline step execution from replay timeout

The v5 combined workflow+step handler wraps inline step bodies in the
same setTimeout(..., REPLAY_TIMEOUT_MS) guard that previously only
bounded the v4 'workflows' function's fast deterministic replay. As a
result, any workflow with a single step exceeding 240s hard-fails with
FatalError: Workflow replay exceeded maximum duration (240s) after 4
attempts — even though the step could legitimately run for the full
function maxDuration (up to 800s on Pro Fluid).

Replace the setTimeout guard with a per-invocation budget that only
accumulates non-step time. pauseReplayBudget() / resumeReplayBudget()
bracket each executeStep() call, and the loop checks the budget at
iteration boundaries. The retry-then-fail semantics from #1567 are
preserved verbatim for the pure-replay case.

Also adds a WORKFLOW_REPLAY_TIMEOUT_MS env var override (clamped to
30s..780s) so operators can adjust the bare-replay ceiling without
patching @workflow/core.

Fixes #2009.

* Address PR review feedback

- Extract budget bookkeeping into ReplayBudget class (replay-budget.ts)
  with sentinel-protected idempotent pause()/resume() to avoid
  double-counting in future refactors that nest step execution
- Restore VERCEL_URL gate around process.exit(1) so a long pure-replay
  in local dev/non-Vercel runtimes can't hard-kill the host process
- Warn (once per distinct raw value) when WORKFLOW_REPLAY_TIMEOUT_MS is
  clamped or rejected, so misconfiguration is observable
- Correct Hobby maxDuration comment (60s standard / 300s Fluid)
- Document budget-check responsiveness trade-off vs. old setTimeout
- Tighten describe-error test assertions to match the full new hint
- Shorten changeset description
- Add ReplayBudget unit tests (9) including 8-minute step regression
- Add warn-once tests for getReplayTimeoutMs (extended)

* Replace VERCEL_URL gate with World capability

Per review feedback, gating runtime behavior on process.env.VERCEL_URL
leaks deployment-environment concerns into @workflow/core. Replace the
check with a new optional capability on the World interface:
processExitTriggersQueueRedelivery (default false).

- @workflow/world: declare the new optional capability on World
- @workflow/world-vercel: set it to true (Vercel fails the function
  invocation on non-zero exit and VQS redelivers via fresh invocation)
- @workflow/core: handleReplayBudgetExhausted reads world.processExitTriggersQueueRedelivery
  instead of process.env.VERCEL_URL; behavior is otherwise unchanged
- Add 4 unit tests for handleReplayBudgetExhausted covering both branches
  (exit-for-redelivery and best-effort run_failed)

---------

Co-authored-by: Peter Wielander <mittgfu@gmail.com>
2026-05-22 00:32:36 +00:00
Nathan Rajlich 3c50f8c77b ci: extract wait-for-vercel-project to vercel/wait-for-deployment-action (#2065)
* ci: extract wait-for-vercel-project to vercel/wait-for-deployment-action

The action's logic was duplicated between this repo and
vercel/workflow-server, which is annoying to keep in sync. Move it to
a standalone repository so both can consume the same pinned build.

Changes:

- Delete .github/actions/wait-for-vercel-project entirely.
- Replace all five `uses: ./.github/actions/wait-for-vercel-project`
  references with `uses: vercel/wait-for-deployment-action@<sha>` in:
    benchmarks.yml, dispatch-front-workflow-release-pr.yml,
    docs-checks.yml, tarballs-checks.yml, tests.yml
- All `with:` inputs (project-slug, environment, timeout,
  check-interval, github-token) are unchanged — the new action's
  input contract is backwards-compatible.

The new action is ESM-only, targets Node 24, ships a ~12KB bundle
(down from ~830KB in the old in-repo version) by dropping
@actions/core and its transitive undici dependency, and is
unit-tested. See https://github.com/vercel/wait-for-deployment-action.

* ci: bump wait-for-deployment-action to fix/status-context-auto for verification

Repinning to vercel/wait-for-deployment-action#fix/status-context-auto
(SHA 04d46ef) which fixes the broken 'opt-out' heuristic that made
status-context resolution silently disabled for every consumer.

Reproduced in this repo's E2E logs:

  Looking for GitHub deployment in environment "Preview – example-workflow"
  Deployment ID resolution disabled (status-context is empty)
  Deployment ready: https://example-workflow-...labs.vercel.dev
  Run E2E Tests: VERCEL_DEPLOYMENT_ID=         <-- empty

Will repin to the post-merge main SHA once CI is green.

* ci: bump wait-for-deployment-action pin to merged main SHA

Repinning from the fix/status-context-auto branch (04d46ef) to the
post-merge main SHA (0e2b0c5, vercel/wait-for-deployment-action#4).
The deployment-id resolution fix verified against the prior fix-branch
pin (E2E tests now read VERCEL_DEPLOYMENT_ID=dpl_... correctly across
the matrix; only flaky/unrelated Vercel deployment failures remain).

* ci: grant statuses:read alongside deployments:read

The wait-for-deployment-action also reads the 'Vercel – <slug>'
combined commit status to resolve the dpl_xxx ID. The official
permissions table lists statuses:read for
GET /repos/{owner}/{repo}/commits/{ref}/status.
2026-05-21 17:28:13 -07:00
JJ Kasper 1d7bc24b3d Fix Next workbench cached outputs (#2071) 2026-05-21 17:13:05 -07:00
Nathan Rajlich 7d728249e5 ci(backport): include full commit SHA in no-backport comment (#2057)
GitHub Actions doesn't currently support prefilling workflow_dispatch
inputs via URL query params (community/community#51159), so the
"override via workflow_dispatch with this commit SHA" instruction in
the no-backport comment required the reader to go look up the SHA
themselves. Paste the full 40-char SHA into the comment in a fenced
code block so it's one click to copy into the "Commit SHA" input on
the workflow run page.
2026-05-21 17:04:39 -07:00
Nathan Rajlich 49da6c50b3 feat(core): support passing parent WritableStream to child workflow via start() (#2059)
* test(e2e): cover WritableStream passed as start() argument

Adds an e2e workflow + test where a parent workflow gets a WritableStream
via getWritable(), forwards it through start() to a child workflow, and
the child step writes raw bytes to it. Asserts the external reader on
the parent's stream observes the exact bytes the child wrote.

* fix(core): avoid double-framing when WritableStream is forwarded via start()

When a workflow's getWritable() handle is passed across start() to a
child workflow, the parent step's reviver wraps it in a serialize
transform that pipes into a workflow server stream. Until now,
getExternalReducers.WritableStream then installed a second serialize
transform on top of that — so every chunk the child step wrote got
devalue-framed twice but only deframed once on the reader side, and
external consumers saw the inner frame instead of the original bytes.

Fix: tag every user-visible writable that's already backed by a
workflow server stream with its (runId, name). When the external
reducer recognizes those tags during dehydration, it bridges bytes
straight from the new child-side server stream to the original server
stream instead of piping through the user's writable. That leaves the
producer-side serialize transform (installed once by the child's step
reviver) as the only framing layer in the chain.

* fix(core): forward (runId, name) when a tagged WritableStream crosses start()

Replaces the previous in-process bridge with first-class writable
forwarding at the descriptor level. When a parent workflow's
getWritable() handle is passed as an argument to a child workflow,
the dehydrated descriptor now carries the original (runId, name).
The child run's step-side reviver opens the writable against the
parent's server stream directly and resolves the parent run's
encryption key (encrypt-only) via getEncryptionKeyForRun.

This removes the architectural limitation that the bridge could
only stay alive for the duration of the parent step process — on
Vercel that capped forwarding at ~15 minutes regardless of the
child run's lifetime, dropping any writes the child made after the
parent step process exited.

importKey() now accepts a usages parameter, defaulting to
['encrypt', 'decrypt']. The cross-run forwarding path imports with
['encrypt'] only so a compromised child run cannot decrypt any
existing data on the parent's stream — only contribute new writes.

* test: rename writable-forwarded workflows and cover step-context getWritable()

Addresses PR review:

- Rename writableForwardedToChildChildWorkflow → writableForwardedChildWorkflow
  (drops the duplicated 'Child' segment).
- Split writableForwardedToChildWorkflow into two variants covered by a
  test.each: writableForwardedFromWorkflowWorkflow (workflow-context
  getWritable, the original test) and writableForwardedFromStepWorkflow
  (step-context getWritable passed directly into start() from the same
  step that called getWritable()).
- Terser changeset description.
2026-05-21 23:56:36 +00:00
Pranay Prakash 1d3959eaa8 Capture world contract failures as fatal (#2060) 2026-05-21 20:09:13 +00:00
Karthik Kalyan ee61817865 ci: pin third-party GitHub Actions to commit SHAs (#2050)
Major-version refs like `@v2`/`@v5` resolve to mutable refs on the
upstream repos — sometimes a tag, sometimes a branch (e.g. marocchino
keeps `v1`/`v2`/`v3` as branches), and dawidd6 force-pushes the bare
`v6` tag forward outside of releases. A compromised maintainer account
could push new code that our CI picks up on the next run with
GITHUB_TOKEN (or, for changesets/action, NPM_TOKEN) in hand.

Pin all third-party `uses:` references to full commit SHAs with a
trailing version comment so the upstream release is still visible to
reviewers. Dependabot/Renovate can keep these fresh going forward.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-21 00:13:40 +00:00
Nathan Rajlich ef69e829b3 ci(backport): mark not-maintained-on-stable list as exhaustive and require git verification (#2051)
* ci(backport): mark not-maintained-on-stable list as exhaustive and require git verification

The backport workflow's AI decision prompt only listed `docs/` (outside
`docs/content/`) and `skills/` as paths not maintained on `stable`, but
didn't flag that list as exhaustive. On at least one commit, the AI
generalized the pattern and incorrectly claimed `tarballs/` was also
not maintained on `stable` (it is) — likely because the commit subject
mentioned "preview tarball" and the changed files included a docs
preview smoke check workflow.

Tighten the prompt to:
- explicitly mark the not-maintained list as exhaustive;
- instruct the AI to run `git ls-tree origin/stable -- <path>` to
  verify any other path it wants to cite as main-only;
- warn it not to infer main-only-ness from suggestive names like
  "docs", "preview", "tarball", or "workflow".

* ci(backport): link to the backport job run in posted comments and PR body

Each of the comments the backport workflow posts (no-backport,
backport-created, conflict-failure) and the body of the backport PR
it opens now includes a link to the GitHub Actions run that produced
the decision. Makes it easy to jump from the comment straight to the
opencode output, prompt, and AI reasoning when the AI gets a call wrong.
2026-05-20 16:58:15 -07:00
Karthik Kalyan 94572d741f ci: publish gh-pages updates via signed GraphQL commits (#2047)
The repo's enterprise `~ALL` required-signatures ruleset rejects the
unsigned commits produced by `peaceiris/actions-gh-pages@v4`, breaking
the benchmark and E2E result publishing jobs on `main`. Replace those
steps with a shared composite action that uses the GraphQL
`createCommitOnBranch` mutation — same pattern already used by
`backport.yml` — so commits are signed automatically by GitHub and
satisfy the rule.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-20 16:25:54 -07:00
Pranay Prakash b062b28d55 [codex] Fix preview tarball generated versions (#2044)
* Fix preview tarball generated versions

* Skip docs smoke for skipped preview deployments

* Address tarball review comments
2026-05-20 16:06:15 -07:00
Nathan Rajlich 96e2d3c56f [world-testing] fix flow invocation counter race in inline-execution tests (#2043)
The test server's flow handler awaited flowPOST before incrementing the
invocation counter, which races with the test polling getRun() to see
the completed status. When the workflow completed inside flowPOST and
flushed the run to the DB, the test could observe the completed state
and immediately query /_flow-invocations before the counter was bumped,
yielding a flaky 'expected 0 to be 1' assertion.

Increment the counter before awaiting flowPOST so the count is
observable as soon as the run transitions to completed.
2026-05-20 16:05:48 -07:00
Pranay Prakash ad71b58bba Report corrupted event logs distinctly (#2046) 2026-05-20 23:04:10 +00:00
Mitul Shah 753e39e3bb trace viewer bug fix + file cleanup (#2036)
* Update timeline.tsx

* Update timeline.tsx

* Update timeline.tsx

* Update changeset title for trace viewer fix

Signed-off-by: Mitul Shah <mitulxshah@gmail.com>

* Update timeline.tsx

---------

Signed-off-by: Mitul Shah <mitulxshah@gmail.com>
2026-05-20 15:12:48 -07:00
Mitul Shah 366f9cc967 Add reduced motion for the trace viewer (#2045)
* add reduced motion

* Add reduced motion for trace viewer

Implement reduced motion settings for the trace viewer.

Signed-off-by: Mitul Shah <mitulxshah@gmail.com>

---------

Signed-off-by: Mitul Shah <mitulxshah@gmail.com>
2026-05-20 21:43:31 +00:00
Pranay Prakash dc0be50618 [codex] Forward port stale wait replay fix (#2038)
* Forward port stale wait replay fix

* Guard V5 replay writes against stale events

* Revert "Guard V5 replay writes against stale events"

This reverts commit 22e74d3558.

* Update wait replay comments
2026-05-20 14:41:25 -07:00
Karthik Kalyan 640baa806e Add minimum release age configuration and exclusions (#2037)
Sets pnpm's `minimumReleaseAge` to 2 days (company-wide standard) and
excludes internal scopes from the gate.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-20 12:50:05 -07:00
Mitul Shah 5a393a6ffc Trace Viewer colour updates (#2022)
* tweaks

* Update trace-viewer.tsx

* Update Trace Viewer colors

Signed-off-by: Mitul Shah <mitulxshah@gmail.com>

* Update timeline.tsx

* Update event-list.tsx

---------

Signed-off-by: Mitul Shah <mitulxshah@gmail.com>
2026-05-20 14:56:29 -04:00
Pranay Prakash b124365e14 [codex] Guard event consumers during replay (#2030)
* Guard event consumers during replay

* Address event guard review feedback

* Update event guard test fixtures
2026-05-20 11:40:03 -07:00