Repository navigation
Let Myra author a workflow code package into a hub asset (CL-7360) - #552
Merged
Merged
Conversation
TheGreatAxios
force-pushed
the
cl-7360-authoring-tool
branch
from
September 2, 2026 07:44
833e19c to
ef5bd6a
Compare
TheGreatAxios
changed the base branch from
cl-7349-contracts
to
cl-7358-target-edit
September 2, 2026 07:45
TheGreatAxios
force-pushed
the
cl-7360-authoring-tool
branch
2 times, most recently
from
September 2, 2026 09:12
13d3d3c to
d590642
Compare
A create or PATCH-carried retarget now must clear the same two gates before it is persisted: resolveLaunchableDefinition must resolve the asset, and the acting principal must be authorized for workflow-definition:<id>/read — the same verb listRoutineTargets already checks per row. A denial is a typed 403 alongside the existing 400/404/409 target envelopes, on both the tenant-session and Myra's workflow-run-authenticated routine surfaces. Also routes a pre-existing catch in postRoutineEnabledNotice through reportError, since this change's diff now touches that line and check:report-error requires it.
…dSha, source read, and the authoring tool bundle
agent-workflow-authoring: validate the source tree at the trust boundary (repo-relative paths, no secret-like names, package.json with an interchange.workflow entry the tree carries, size caps), honor an optional expectedHeadSha on republish (409 with the current head), and add GET /:assetId/source authorized as asset:<id>/read. workflow-authoring-tools: a new @intx/agent bundle (workflow_author, workflow_republish, workflow_source_read) over those run-authenticated routes, published to the corbits-tools registry, pinned by the assistant, threaded hubWorkflowAuthoringUrl in the sidecar step env, and offered in the hub's tool-package inventory.
…ish conflict semantics
TheGreatAxios
force-pushed
the
cl-7360-authoring-tool
branch
from
September 2, 2026 10:50
d590642 to
5ea5e91
Compare
TheGreatAxios
marked this pull request as ready for review
September 2, 2026 11:09
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Linear: https://linear.app/abklabs/issue/CL-7360
What
@corbits/agent-workflow-authoring: trust-boundary validation of the source tree (validateWorkflowSourceTree: repo-relative paths, no../.git/backslashes, secret-like names refused,package.jsonmust declare aninterchange.workflowentry the tree carries, per-file/tree/count caps), optionalexpectedHeadShaon republish (409 +currentHeadSha), andGET /api/workflow-workflow-authoring/:assetId/sourceauthorizedasset:<id>/read. Head sha and tree reads go throughRepoStore.resolveRef/openCommittedReads:AssetServiceexposes neither the head sha nor subtree listing.@corbits/workflow-authoring-tools(0.0.1):workflow_author,workflow_republish,workflow_source_read; noapproval: "ask". Registered intool-registry-publish, pinned inASSISTANT_TOOL_PACKAGE_PINS,hubWorkflowAuthoringUrlthreaded in the sidecar step env, offered in the hub inventory.docs/workflow-source-authoring.mdseams list; README for the new package.Notes
@corbits/workflow_authoring/wf(not the package name) so<id>:<tool>fits the 64-char OpenAI wire cap afterencodeToolName.expectedHeadShais read-then-write (writeTreehas no CAS); republish is additive (no rootclearPrefix). Both documented as remaining seams.request_capabilitystays self-definition only by design (the route 403s any other definitionId); not changed here.bun run checkwas not run to completion after the last lint fix (budget cut); typecheck, targeted tests, eslint on the touched packages,check:tool-package-pins, andcheck:tsconfig-referencespass.Resolves CL-7360