= {};
if (hostDelivered && Object.keys(hostDelivered).length > 0) {
diff --git a/sdk/typescript/tests/unit/worker.test.ts b/sdk/typescript/tests/unit/worker.test.ts
index 55c99c98..65185da2 100644
--- a/sdk/typescript/tests/unit/worker.test.ts
+++ b/sdk/typescript/tests/unit/worker.test.ts
@@ -550,6 +550,39 @@ describe("WorkerManager", () => {
expect(contextAvailable).toBe(true);
});
+ it("prefers host-delivered task.runtimeMetadata over the native pull (embedded)", async () => {
+ // Embedded: the host resolves the worker's declared TaskDef.runtimeMetadata secret names and
+ // delivers the values on the wire-only Task.runtimeMetadata. The worker must use that map and
+ // never hit the native /workers/secrets endpoint, even with no execution token present.
+ const serverUrl = "http://cred-embedded";
+ const manager = new WorkerManager(serverUrl, {}, 100);
+
+ let resolved: string | undefined;
+ manager.addWorker("rtm_task", async () => {
+ const { getCredential } = await import("../../src/credentials.js");
+ resolved = await getCredential("MY_CRED");
+ return { ok: true };
+ });
+
+ const fetchSpy = vi.fn().mockResolvedValue({ ok: true, status: 200, text: async () => "" });
+ vi.stubGlobal("fetch", fetchSpy);
+
+ const wrapped = (manager as any)._wrapWorker((manager as any).pendingWorkers[0]);
+ await wrapped.execute({
+ taskId: "task-1",
+ workflowInstanceId: "wf-1",
+ inputData: { arg1: "value" }, // no __agentspan_ctx__ execution token
+ runtimeMetadata: { MY_CRED: "host-value" },
+ });
+
+ expect(resolved).toBe("host-value");
+ expect(
+ fetchSpy.mock.calls.some(
+ ([u]: [unknown]) => typeof u === "string" && u.includes("/workers/secrets"),
+ ),
+ ).toBe(false);
+ });
+
it("clears credential context after handler completes", async () => {
const manager = new WorkerManager("http://test", {}, 100);
diff --git a/server/build.gradle b/server/build.gradle
index ee3a3b9c..abfabb53 100644
--- a/server/build.gradle
+++ b/server/build.gradle
@@ -15,11 +15,11 @@ repositories {
// ── Version catalog ──────────────────────────────────────────────
ext {
- // AgentSpan compiles/tests against the published conductor. Embedded secret delivery uses
- // ${workflow.secrets.NAME} references resolved at runtime by the HOST conductor's
- // ParametersUtils.substituteSecrets / SecretsDAO (conductor-oss PR #1255) — agentspan itself
- // references no PR #1255 API, so it does not need to build against it.
- conductorVersion = '3.32.0-rc.3'
+ // TARGET branch: worker secrets use TaskDef.runtimeMetadata (conductor-oss PR #1255), so the
+ // server references TaskDef.setRuntimeMetadata and must build against a conductor that has it.
+ // Pinned to the local runtimemeta build (superset of 3.32.0-rc.3); revert to a published version
+ // once PR #1255 ships. (The interim on feature/embedded-secret-toggle builds against 3.32.0-rc.3.)
+ conductorVersion = '3.32.0-rc.5'
lombokVersion = '1.18.42'
log4jVersion = '2.24.3'
sqliteJdbcVersion = '3.47.0.0'
diff --git a/server/conductor-agentspan-server/src/main/java/dev/agentspan/runtime/credentials/AgentspanSecretsDAO.java b/server/conductor-agentspan-server/src/main/java/dev/agentspan/runtime/credentials/AgentspanSecretsDAO.java
new file mode 100644
index 00000000..af6023c7
--- /dev/null
+++ b/server/conductor-agentspan-server/src/main/java/dev/agentspan/runtime/credentials/AgentspanSecretsDAO.java
@@ -0,0 +1,92 @@
+/*
+ * Copyright (c) 2025 AgentSpan
+ * Licensed under the MIT License.
+ */
+package dev.agentspan.runtime.credentials;
+
+import java.util.List;
+import java.util.stream.Collectors;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.stereotype.Component;
+
+import com.netflix.conductor.dao.SecretsDAO;
+
+import dev.agentspan.runtime.model.credentials.CredentialMeta;
+import dev.agentspan.runtime.spi.CredentialStoreProvider;
+
+/**
+ * Bridges conductor's global {@link SecretsDAO} to AgentSpan's own {@link CredentialStoreProvider}
+ * (the encrypted credential store), scoped to the anonymous/system user.
+ *
+ * Active only when {@code conductor.secrets.type=agentspan} — the "agentspan-as-host" mode where
+ * the AgentSpan server embeds conductor ({@code agentspan.embedded=true}) and also serves as
+ * the secret-resolving host. In that mode the embedded conductor's {@code RuntimeMetadataResolver}
+ * calls {@link #getSecret(String)} at each SIMPLE task's poll to resolve the secret names a worker
+ * declared on {@code TaskDef.runtimeMetadata}, injecting the resolved values onto the wire-only
+ * {@code Task.runtimeMetadata}. Selecting this DAO ({@code havingValue="agentspan"}) gates conductor's
+ * own env-variable / noop {@code SecretsDAO} implementations off (they require
+ * {@code conductor.secrets.type} to be {@code env}/absent or {@code noop}).
+ *
+ * Conductor secrets are global (name only); AgentSpan's store is per-user, so every lookup is
+ * scoped to {@link #ANONYMOUS_USER_ID} — the no-auth/system user, matching {@code CredentialEnvSeeder}
+ * and {@code AuthFilter.ANONYMOUS}. Names are treated as flat keys (no dotted JSONPath): worker
+ * credential names are simple identifiers, and {@link CredentialStoreProvider#get} resolves them
+ * directly.
+ *
+ * The backing store beans ({@code EncryptedDbCredentialStoreProvider}, {@code MasterKeyConfig},
+ * {@code CredentialDataSourceConfig}, {@code CredentialSchemaMigrator}) are normally dormant when
+ * embedded; they are re-enabled under this same {@code conductor.secrets.type=agentspan} flag so this
+ * bridge has a store to read from.
+ */
+@Component
+@ConditionalOnProperty(name = "conductor.secrets.type", havingValue = "agentspan")
+public class AgentspanSecretsDAO implements SecretsDAO {
+
+ private static final Logger log = LoggerFactory.getLogger(AgentspanSecretsDAO.class);
+
+ /**
+ * User ID for the anonymous/OSS user — matches {@code CredentialEnvSeeder.ANONYMOUS_USER_ID} and
+ * {@code AuthFilter.ANONYMOUS}. Conductor's global secret lookups resolve against this user.
+ */
+ static final String ANONYMOUS_USER_ID = "00000000-0000-0000-0000-000000000000";
+
+ private final CredentialStoreProvider store;
+
+ public AgentspanSecretsDAO(CredentialStoreProvider store) {
+ this.store = store;
+ log.info(
+ "AgentspanSecretsDAO active — embedded conductor secrets resolve from the AgentSpan "
+ + "credential store (scoped to system user {})",
+ ANONYMOUS_USER_ID);
+ }
+
+ @Override
+ public String getSecret(String key) {
+ return store.get(ANONYMOUS_USER_ID, key);
+ }
+
+ @Override
+ public boolean secretExists(String key) {
+ return store.get(ANONYMOUS_USER_ID, key) != null;
+ }
+
+ @Override
+ public List listSecretNames() {
+ return store.list(ANONYMOUS_USER_ID).stream()
+ .map(CredentialMeta::getName)
+ .collect(Collectors.toList());
+ }
+
+ @Override
+ public void putSecret(String key, String value) {
+ store.set(ANONYMOUS_USER_ID, key, value);
+ }
+
+ @Override
+ public void deleteSecret(String key) {
+ store.delete(ANONYMOUS_USER_ID, key);
+ }
+}
diff --git a/server/conductor-agentspan-server/src/main/java/dev/agentspan/runtime/credentials/CredentialDataSourceConfig.java b/server/conductor-agentspan-server/src/main/java/dev/agentspan/runtime/credentials/CredentialDataSourceConfig.java
index a9d3c2c9..dc7ef9db 100644
--- a/server/conductor-agentspan-server/src/main/java/dev/agentspan/runtime/credentials/CredentialDataSourceConfig.java
+++ b/server/conductor-agentspan-server/src/main/java/dev/agentspan/runtime/credentials/CredentialDataSourceConfig.java
@@ -51,7 +51,7 @@
* PostgreSQL: uses {@code org.postgresql.Driver} with a larger pool (default 8).
*/
@Configuration
-@ConditionalOnProperty(name = "agentspan.embedded", havingValue = "false", matchIfMissing = true)
+@ConditionalOnProperty(name = "conductor.secrets.type", havingValue = "agentspan")
public class CredentialDataSourceConfig {
private static final Logger log = LoggerFactory.getLogger(CredentialDataSourceConfig.class);
diff --git a/server/conductor-agentspan-server/src/main/java/dev/agentspan/runtime/credentials/CredentialSchemaMigrator.java b/server/conductor-agentspan-server/src/main/java/dev/agentspan/runtime/credentials/CredentialSchemaMigrator.java
index 17011b1b..83c83c8c 100644
--- a/server/conductor-agentspan-server/src/main/java/dev/agentspan/runtime/credentials/CredentialSchemaMigrator.java
+++ b/server/conductor-agentspan-server/src/main/java/dev/agentspan/runtime/credentials/CredentialSchemaMigrator.java
@@ -31,7 +31,7 @@
* pre-release development builds.
*/
@Component
-@ConditionalOnProperty(name = "agentspan.embedded", havingValue = "false", matchIfMissing = true)
+@ConditionalOnProperty(name = "conductor.secrets.type", havingValue = "agentspan")
public class CredentialSchemaMigrator {
private static final Logger log = LoggerFactory.getLogger(CredentialSchemaMigrator.class);
diff --git a/server/conductor-agentspan-server/src/main/java/dev/agentspan/runtime/credentials/EncryptedDbCredentialStoreProvider.java b/server/conductor-agentspan-server/src/main/java/dev/agentspan/runtime/credentials/EncryptedDbCredentialStoreProvider.java
index 6bc8a38e..4fcd66fb 100644
--- a/server/conductor-agentspan-server/src/main/java/dev/agentspan/runtime/credentials/EncryptedDbCredentialStoreProvider.java
+++ b/server/conductor-agentspan-server/src/main/java/dev/agentspan/runtime/credentials/EncryptedDbCredentialStoreProvider.java
@@ -35,7 +35,7 @@
* The master key is the 32-byte key from {@code MasterKeyConfig#credentialMasterKey()}.
*/
@Component
-@ConditionalOnProperty(name = "agentspan.embedded", havingValue = "false", matchIfMissing = true)
+@ConditionalOnProperty(name = "conductor.secrets.type", havingValue = "agentspan")
public class EncryptedDbCredentialStoreProvider implements CredentialStoreProvider {
private static final Logger log = LoggerFactory.getLogger(EncryptedDbCredentialStoreProvider.class);
diff --git a/server/conductor-agentspan-server/src/main/java/dev/agentspan/runtime/credentials/MasterKeyConfig.java b/server/conductor-agentspan-server/src/main/java/dev/agentspan/runtime/credentials/MasterKeyConfig.java
index 6a2bb937..ff1f7a3a 100644
--- a/server/conductor-agentspan-server/src/main/java/dev/agentspan/runtime/credentials/MasterKeyConfig.java
+++ b/server/conductor-agentspan-server/src/main/java/dev/agentspan/runtime/credentials/MasterKeyConfig.java
@@ -29,7 +29,7 @@
*
*/
@Configuration
-@ConditionalOnProperty(name = "agentspan.embedded", havingValue = "false", matchIfMissing = true)
+@ConditionalOnProperty(name = "conductor.secrets.type", havingValue = "agentspan")
public class MasterKeyConfig {
private static final Logger log = LoggerFactory.getLogger(MasterKeyConfig.class);
diff --git a/server/conductor-agentspan-server/src/main/resources/application.properties b/server/conductor-agentspan-server/src/main/resources/application.properties
index 3906a87f..ba92767f 100644
--- a/server/conductor-agentspan-server/src/main/resources/application.properties
+++ b/server/conductor-agentspan-server/src/main/resources/application.properties
@@ -162,6 +162,16 @@ agentspan.credentials.store=built-in
agentspan.credentials.strict-mode=false
agentspan.credentials.resolve.rate-limit=120
+# Secret backend for the embedded conductor (RuntimeMetadataResolver at task poll, and
+# ${workflow.secrets.NAME} substitution). 'agentspan' backs it with AgentSpan's encrypted
+# credential store via AgentspanSecretsDAO and activates the store beans (datasource, master
+# key, schema migrator, store provider) — the same store the native credential services use.
+# Defaulted on so the standalone server keeps its store; when embedded as the secret-resolving
+# host, set agentspan.embedded=true and leave this at 'agentspan'. Override to conductor's own
+# 'env'/'noop' backend only when the host delivers secrets and the native store is not wanted
+# (the native credential services require the AgentSpan store, so do not override it standalone).
+conductor.secrets.type=${CONDUCTOR_SECRETS_TYPE:agentspan}
+
# Mask secrets from the host-owned /api/workflow/{id} (raw Conductor) read path too.
# Off by default so embedding this library never mutates a host's workflow responses;
# AgentSpan's own /api/agent/* reads are always masked regardless of this flag.
diff --git a/server/conductor-agentspan-server/src/test/java/dev/agentspan/runtime/credentials/AgentspanSecretsDAOTest.java b/server/conductor-agentspan-server/src/test/java/dev/agentspan/runtime/credentials/AgentspanSecretsDAOTest.java
new file mode 100644
index 00000000..82ccbd72
--- /dev/null
+++ b/server/conductor-agentspan-server/src/test/java/dev/agentspan/runtime/credentials/AgentspanSecretsDAOTest.java
@@ -0,0 +1,122 @@
+/*
+ * Copyright (c) 2025 AgentSpan
+ * Licensed under the MIT License.
+ */
+package dev.agentspan.runtime.credentials;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
+
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.boot.test.context.runner.ApplicationContextRunner;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Import;
+
+import dev.agentspan.runtime.model.credentials.CredentialMeta;
+import dev.agentspan.runtime.spi.CredentialStoreProvider;
+
+/**
+ * {@link AgentspanSecretsDAO} bridges conductor's global {@code SecretsDAO} to AgentSpan's per-user
+ * {@link CredentialStoreProvider}, scoped to the anonymous/system user. Verifies the name→value
+ * round-trip is scoped to {@code ANONYMOUS_USER_ID} (so other users' secrets are invisible) and that
+ * the bean is selected only by {@code conductor.secrets.type=agentspan}.
+ */
+class AgentspanSecretsDAOTest {
+
+ private static final String ANON = "00000000-0000-0000-0000-000000000000";
+
+ /** In-memory {@link CredentialStoreProvider} keyed by (userId,name) so scope can be asserted. */
+ static class FakeStore implements CredentialStoreProvider {
+ final Map data = new LinkedHashMap<>();
+
+ private static String k(String u, String n) {
+ return u + "|" + n;
+ }
+
+ @Override
+ public String get(String userId, String name) {
+ return data.get(k(userId, name));
+ }
+
+ @Override
+ public void set(String userId, String name, String value) {
+ data.put(k(userId, name), value);
+ }
+
+ @Override
+ public void delete(String userId, String name) {
+ data.remove(k(userId, name));
+ }
+
+ @Override
+ public List list(String userId) {
+ List out = new ArrayList<>();
+ for (String key : data.keySet()) {
+ int bar = key.indexOf('|');
+ if (key.substring(0, bar).equals(userId)) {
+ out.add(CredentialMeta.builder().name(key.substring(bar + 1)).build());
+ }
+ }
+ return out;
+ }
+ }
+
+ @Test
+ void roundTrip_scopedToAnonymousUser() {
+ FakeStore store = new FakeStore();
+ AgentspanSecretsDAO dao = new AgentspanSecretsDAO(store);
+
+ assertThat(dao.secretExists("GITHUB_TOKEN")).isFalse();
+ assertThat(dao.getSecret("GITHUB_TOKEN")).isNull();
+
+ dao.putSecret("GITHUB_TOKEN", "ghp_x");
+ // written under the anonymous/system user — the scope conductor resolves against
+ assertThat(store.data).containsEntry(ANON + "|GITHUB_TOKEN", "ghp_x");
+ assertThat(dao.getSecret("GITHUB_TOKEN")).isEqualTo("ghp_x");
+ assertThat(dao.secretExists("GITHUB_TOKEN")).isTrue();
+
+ dao.putSecret("SLACK_TOKEN", "xoxb");
+ assertThat(dao.listSecretNames()).containsExactlyInAnyOrder("GITHUB_TOKEN", "SLACK_TOKEN");
+
+ dao.deleteSecret("GITHUB_TOKEN");
+ assertThat(dao.getSecret("GITHUB_TOKEN")).isNull();
+ assertThat(dao.listSecretNames()).containsExactly("SLACK_TOKEN");
+ }
+
+ @Test
+ void doesNotReadOtherUsersSecrets() {
+ FakeStore store = new FakeStore();
+ store.set("some-other-user", "GITHUB_TOKEN", "not-mine");
+ AgentspanSecretsDAO dao = new AgentspanSecretsDAO(store);
+ assertThat(dao.getSecret("GITHUB_TOKEN")).isNull();
+ assertThat(dao.listSecretNames()).isEmpty();
+ }
+
+ // ── gating: selected only by conductor.secrets.type=agentspan ──
+
+ @Configuration
+ @Import(AgentspanSecretsDAO.class)
+ static class DaoConfig {}
+
+ private final ApplicationContextRunner runner = new ApplicationContextRunner()
+ .withBean(CredentialStoreProvider.class, () -> mock(CredentialStoreProvider.class))
+ .withUserConfiguration(DaoConfig.class);
+
+ @Test
+ void beanPresent_whenConductorSecretsTypeAgentspan() {
+ runner.withPropertyValues("conductor.secrets.type=agentspan")
+ .run(ctx -> assertThat(ctx).hasSingleBean(AgentspanSecretsDAO.class));
+ }
+
+ @Test
+ void beanAbsent_whenFlagUnsetOrDifferent() {
+ runner.run(ctx -> assertThat(ctx).doesNotHaveBean(AgentspanSecretsDAO.class));
+ runner.withPropertyValues("conductor.secrets.type=env")
+ .run(ctx -> assertThat(ctx).doesNotHaveBean(AgentspanSecretsDAO.class));
+ }
+}
diff --git a/server/conductor-agentspan-server/src/test/java/dev/agentspan/runtime/util/EnrichToolsScriptTest.java b/server/conductor-agentspan-server/src/test/java/dev/agentspan/runtime/util/EnrichToolsScriptTest.java
index 6949246d..3f97bfbc 100644
--- a/server/conductor-agentspan-server/src/test/java/dev/agentspan/runtime/util/EnrichToolsScriptTest.java
+++ b/server/conductor-agentspan-server/src/test/java/dev/agentspan/runtime/util/EnrichToolsScriptTest.java
@@ -55,7 +55,7 @@ private List> enrichWithAgentTools(
private List> enrichWithConfigs(
String httpJson, String agentToolJson, String knownNamesJson, String toolCallsJson) throws Exception {
String script = JavaScriptBuilder.enrichToolsScript(
- httpJson, "{}", "{}", agentToolJson, "{}", "{}", "{}", "{}", knownNamesJson, "{}");
+ httpJson, "{}", "{}", agentToolJson, "{}", "{}", "{}", "{}", knownNamesJson);
// Wrap so the script's IIFE return is captured AND we get a JSON string
// back — Graal's Value.toString() is JS source, not JSON.
String wrapped = "var $ = {"
diff --git a/server/conductor-agentspan/src/main/java/dev/agentspan/runtime/compiler/AgentCompiler.java b/server/conductor-agentspan/src/main/java/dev/agentspan/runtime/compiler/AgentCompiler.java
index 52192239..6fe6d2b7 100644
--- a/server/conductor-agentspan/src/main/java/dev/agentspan/runtime/compiler/AgentCompiler.java
+++ b/server/conductor-agentspan/src/main/java/dev/agentspan/runtime/compiler/AgentCompiler.java
@@ -342,11 +342,11 @@ WorkflowDef compileSimple(AgentConfig config) {
/**
* Collect {@code toolName -> [credentialNames]} for the agent's tools: each tool's own declared
- * credentials, falling back to the agent-level credential list. Fed to
- * {@link ToolCompiler#setWorkerCreds} so SIMPLE worker tasks carry {@code __resolved_credentials__}
- * secret references in embedded mode.
+ * credentials, falling back to the agent-level credential list. Used by {@code AgentService} to
+ * declare each worker tool's {@code TaskDef.runtimeMetadata} (embedded), so the host resolves the
+ * names at the SIMPLE task's poll and injects the values onto {@code Task.runtimeMetadata}.
*/
- static Map> collectToolCredentials(AgentConfig config) {
+ public static Map> collectToolCredentials(AgentConfig config) {
List agentCreds = config.getCredentials() != null ? config.getCredentials() : List.of();
Map> map = new LinkedHashMap<>();
if (config.getTools() != null) {
@@ -359,12 +359,30 @@ static Map> collectToolCredentials(AgentConfig config) {
}
}
List effective = own.isEmpty() ? agentCreds : own;
- if (!effective.isEmpty()) map.put(tool.getName(), new ArrayList<>(effective));
+ if (!effective.isEmpty()) map.put(tool.getName(), new ArrayList<>(new LinkedHashSet<>(effective)));
}
}
return map;
}
+ /**
+ * Collect the agent-level credential names, deduped and order-preserving. Used by
+ * {@code AgentService} to declare {@code TaskDef.runtimeMetadata} (embedded) on the non-worker
+ * SIMPLE tasks that run user-authored code — guardrails, callbacks, stop_when, gates, instructions,
+ * routers, graph node/edge workers — none of which carry their own per-item credential list, so the
+ * agent-level list is their only source. The host resolves the names at each task's poll and injects
+ * the values onto the wire-only {@code Task.runtimeMetadata}.
+ *
+ * Note: the SDK worker wrappers for these non-worker task kinds do not yet read
+ * {@code Task.runtimeMetadata} (only the tool worker does), so declaring it here is currently inert —
+ * the values ride the wire but {@code get_secret()} inside those user functions won't resolve until
+ * the SDK wrappers are taught to route {@code runtimeMetadata} into the credential context.
+ */
+ public static List collectAgentCredentials(AgentConfig config) {
+ if (config.getCredentials() == null || config.getCredentials().isEmpty()) return List.of();
+ return new ArrayList<>(new LinkedHashSet<>(config.getCredentials()));
+ }
+
WorkflowDef compileWithTools(AgentConfig config) {
ParsedModel parsed = ModelParser.parse(config.getModel());
String llmRef = toRef(config.getName()) + "_llm";
@@ -372,7 +390,6 @@ WorkflowDef compileWithTools(AgentConfig config) {
List tools = config.getTools();
ToolCompiler tc = new ToolCompiler();
- tc.setWorkerCreds(collectToolCredentials(config));
boolean hasApproval = tools.stream().anyMatch(ToolConfig::isApprovalRequired);
boolean hasMcp = tools.stream().anyMatch(t -> "mcp".equals(t.getToolType()));
boolean hasApi = tools.stream().anyMatch(t -> "api".equals(t.getToolType()));
@@ -747,7 +764,6 @@ WorkflowDef compileHybrid(AgentConfig config) {
}
ToolCompiler tc = new ToolCompiler();
- tc.setWorkerCreds(collectToolCredentials(config));
boolean hasApproval = allTools.stream().anyMatch(ToolConfig::isApprovalRequired);
boolean hasMcp = allTools.stream().anyMatch(t -> "mcp".equals(t.getToolType()));
boolean hasApi = allTools.stream().anyMatch(t -> "api".equals(t.getToolType()));
diff --git a/server/conductor-agentspan/src/main/java/dev/agentspan/runtime/compiler/MultiAgentCompiler.java b/server/conductor-agentspan/src/main/java/dev/agentspan/runtime/compiler/MultiAgentCompiler.java
index 724e505d..4ebf6ffa 100644
--- a/server/conductor-agentspan/src/main/java/dev/agentspan/runtime/compiler/MultiAgentCompiler.java
+++ b/server/conductor-agentspan/src/main/java/dev/agentspan/runtime/compiler/MultiAgentCompiler.java
@@ -1364,7 +1364,6 @@ WorkflowDef compileSwarmAgentWorkflow(AgentConfig agent, List transf
allTools.addAll(transferTools);
ToolCompiler tc = new ToolCompiler();
- tc.setWorkerCreds(AgentCompiler.collectToolCredentials(agent));
boolean hasApproval = allTools.stream().anyMatch(ToolConfig::isApprovalRequired);
List> toolSpecs = tc.compileToolSpecs(allTools);
@@ -1463,7 +1462,6 @@ private WorkflowDef compileSwarmAgentWorkflowWithSubAgents(AgentConfig agent, Li
// 3. LLM step with transfer tools to decide whether to transfer to a peer
ToolCompiler tc = new ToolCompiler();
- tc.setWorkerCreds(AgentCompiler.collectToolCredentials(agent));
List> transferToolSpecs = tc.compileToolSpecs(transferTools);
WorkflowTask transferLlm = new WorkflowTask();
diff --git a/server/conductor-agentspan/src/main/java/dev/agentspan/runtime/compiler/ToolCompiler.java b/server/conductor-agentspan/src/main/java/dev/agentspan/runtime/compiler/ToolCompiler.java
index 996d011d..80553608 100644
--- a/server/conductor-agentspan/src/main/java/dev/agentspan/runtime/compiler/ToolCompiler.java
+++ b/server/conductor-agentspan/src/main/java/dev/agentspan/runtime/compiler/ToolCompiler.java
@@ -119,55 +119,6 @@ private static Map escapeHeadersInConfig(Map cfg
Map.entry("rag_search", "LLM_SEARCH_INDEX"),
Map.entry("pull_workflow_messages", "PULL_WORKFLOW_MESSAGES"));
- /**
- * Per-tool credential names ({@code toolName -> [names]}) used to stamp
- * {@code __resolved_credentials__} onto SIMPLE worker-tool tasks in EMBEDDED mode, so the host
- * resolves each {@code ${workflow.secrets.NAME}} reference from its secret store at poll time.
- * Set by {@link AgentCompiler} (preserves agent-level credential fallback); empty by default
- * (no stamping — standalone, or non-worker tools whose secrets travel as headers).
- */
- private Map> workerCreds = Map.of();
-
- /** Inject per-tool credential names so worker-tool SIMPLE tasks can carry secret references. */
- void setWorkerCreds(Map> workerCreds) {
- this.workerCreds = workerCreds != null ? workerCreds : Map.of();
- }
-
- /** True if a tool compiles to a SIMPLE worker task (executed by an external SDK worker). */
- private static boolean isWorkerTool(ToolConfig tool) {
- String t = tool.getToolType() != null ? tool.getToolType() : "worker";
- return "SIMPLE".equals(TYPE_MAP.getOrDefault(t, "SIMPLE"));
- }
-
- /**
- * Build {@code {toolName -> {NAME: "${workflow.secrets.NAME}"}}} for this agent's SIMPLE
- * worker tools, EMBEDDED only. The host resolves the references just-in-time at poll (via
- * {@code ParametersUtils.substituteSecrets}); the SDK worker reads {@code __resolved_credentials__}
- * from its task input and strips it. HTTP/MCP tools are excluded — their secrets travel as
- * {@code ${workflow.secrets.NAME}} headers.
- */
- private Map buildWorkerCredConfig(List tools) {
- Map cfg = new LinkedHashMap<>();
- if (!EmbeddedMode.isEmbedded() || tools == null || workerCreds.isEmpty()) {
- return cfg;
- }
- for (ToolConfig tool : tools) {
- if (tool.getName() == null || !isWorkerTool(tool)) {
- continue;
- }
- List names = workerCreds.get(tool.getName());
- if (names == null || names.isEmpty()) {
- continue;
- }
- Map refs = new LinkedHashMap<>();
- for (String name : names) {
- refs.put(name, "${workflow.secrets." + name + "}");
- }
- cfg.put(tool.getName(), refs);
- }
- return cfg;
- }
-
// ── Public API ───────────────────────────────────────────────────────
/**
@@ -465,19 +416,9 @@ public Object[] buildEnrichTask(String agentName, String llmRef, List registered) {
+ // Credential names declared on each SIMPLE task's TaskDef.runtimeMetadata (embedded only, gated
+ // inside registerTaskDef). Worker tools use their per-tool creds (with agent-level fallback);
+ // the other user-code task kinds (guardrail/callback/stop_when/gate/instructions/router/graph)
+ // have no per-item credential list, so they use the agent-level names. Hoisted once per config.
+ Map> toolCreds = AgentCompiler.collectToolCredentials(config);
+ List agentCreds = AgentCompiler.collectAgentCredentials(config);
+
// Register dispatch task for this agent's tools
if (config.getTools() != null) {
for (ToolConfig tool : config.getTools()) {
String tt = tool.getToolType();
if ("worker".equals(tt) && !registered.contains(tool.getName())) {
- registerTaskDef(tool.getName());
+ registerTaskDef(tool.getName(), toolCreds.get(tool.getName()));
registered.add(tool.getName());
}
}
}
- // Register stop_when worker
+ // Register stop_when worker (user-authored predicate → agent-level creds)
if (config.getStopWhen() != null && config.getStopWhen().getTaskName() != null) {
String taskName = config.getStopWhen().getTaskName();
if (!registered.contains(taskName)) {
- registerTaskDef(taskName);
+ registerTaskDef(taskName, agentCreds);
registered.add(taskName);
}
}
@@ -984,7 +992,7 @@ private void collectAndRegisterTasks(AgentConfig config, Set registered)
for (GuardrailConfig g : config.getGuardrails()) {
if ("custom".equals(g.getGuardrailType()) && g.getTaskName() != null) {
if (!registered.contains(g.getTaskName())) {
- registerTaskDef(g.getTaskName());
+ registerTaskDef(g.getTaskName(), agentCreds);
registered.add(g.getTaskName());
}
}
@@ -995,7 +1003,7 @@ private void collectAndRegisterTasks(AgentConfig config, Set registered)
if (config.getCallbacks() != null) {
for (CallbackConfig cb : config.getCallbacks()) {
if (cb.getTaskName() != null && !registered.contains(cb.getTaskName())) {
- registerTaskDef(cb.getTaskName());
+ registerTaskDef(cb.getTaskName(), agentCreds);
registered.add(cb.getTaskName());
}
}
@@ -1004,7 +1012,7 @@ private void collectAndRegisterTasks(AgentConfig config, Set registered)
// Register callable gate workers (text_contains gates are INLINE, no registration needed)
if (config.getGate() != null && config.getGate().get("taskName") instanceof String gateTaskName) {
if (!registered.contains(gateTaskName)) {
- registerTaskDef(gateTaskName);
+ registerTaskDef(gateTaskName, agentCreds);
registered.add(gateTaskName);
}
}
@@ -1014,7 +1022,7 @@ private void collectAndRegisterTasks(AgentConfig config, Set registered)
&& instrMap.get("_worker_ref") instanceof String instrTaskName
&& !instrTaskName.isBlank()) {
if (!registered.contains(instrTaskName)) {
- registerTaskDef(instrTaskName);
+ registerTaskDef(instrTaskName, agentCreds);
registered.add(instrTaskName);
}
}
@@ -1023,12 +1031,12 @@ private void collectAndRegisterTasks(AgentConfig config, Set registered)
if (config.getRouter() instanceof Map routerMap
&& routerMap.get("taskName") instanceof String routerTaskName) {
if (!registered.contains(routerTaskName)) {
- registerTaskDef(routerTaskName);
+ registerTaskDef(routerTaskName, agentCreds);
registered.add(routerTaskName);
}
} else if (config.getRouter() instanceof WorkerRef workerRef && workerRef.getTaskName() != null) {
if (!registered.contains(workerRef.getTaskName())) {
- registerTaskDef(workerRef.getTaskName());
+ registerTaskDef(workerRef.getTaskName(), agentCreds);
registered.add(workerRef.getTaskName());
}
}
@@ -1117,7 +1125,7 @@ private void collectAndRegisterTasks(AgentConfig config, Set registered)
for (Object nodeObj : nodes) {
if (nodeObj instanceof Map node && node.get("_worker_ref") instanceof String workerRef) {
if (!registered.contains(workerRef)) {
- registerTaskDef(workerRef);
+ registerTaskDef(workerRef, agentCreds);
registered.add(workerRef);
}
}
@@ -1128,7 +1136,7 @@ private void collectAndRegisterTasks(AgentConfig config, Set registered)
for (Object ceObj : condEdges) {
if (ceObj instanceof Map ce && ce.get("_router_ref") instanceof String routerRef) {
if (!registered.contains(routerRef)) {
- registerTaskDef(routerRef);
+ registerTaskDef(routerRef, agentCreds);
registered.add(routerRef);
}
}
@@ -1409,6 +1417,16 @@ private String extractSubagentIdentifier(Map event) {
// ── Task registration ────────────────────────────────────────────
private void registerTaskDef(String taskName) {
+ registerTaskDef(taskName, null);
+ }
+
+ /**
+ * Register a worker TaskDef. When embedded, {@code runtimeMetadata} declares the secret names the
+ * host must resolve at the SIMPLE task's poll and inject onto the wire-only
+ * {@code Task.runtimeMetadata} (conductor-oss PR #1255). Standalone leaves it empty — the native
+ * execution-token pull delivers secrets instead.
+ */
+ private void registerTaskDef(String taskName, List runtimeMetadata) {
TaskDef taskDef = new TaskDef();
taskDef.setName(taskName);
taskDef.setRetryCount(2);
@@ -1417,6 +1435,9 @@ private void registerTaskDef(String taskName) {
taskDef.setTimeoutSeconds(0);
taskDef.setResponseTimeoutSeconds(3600);
taskDef.setTimeoutPolicy(TaskDef.TimeoutPolicy.RETRY);
+ if (EmbeddedMode.isEmbedded() && runtimeMetadata != null && !runtimeMetadata.isEmpty()) {
+ taskDef.setRuntimeMetadata(new ArrayList<>(runtimeMetadata));
+ }
try {
TaskDef existing = metadataDAO.getTaskDef(taskName);
diff --git a/server/conductor-agentspan/src/main/java/dev/agentspan/runtime/util/JavaScriptBuilder.java b/server/conductor-agentspan/src/main/java/dev/agentspan/runtime/util/JavaScriptBuilder.java
index f7d07852..91557657 100644
--- a/server/conductor-agentspan/src/main/java/dev/agentspan/runtime/util/JavaScriptBuilder.java
+++ b/server/conductor-agentspan/src/main/java/dev/agentspan/runtime/util/JavaScriptBuilder.java
@@ -526,8 +526,7 @@ public static String enrichToolsScript(
String cliConfigJson,
String humanConfigJson,
String wmqConfigJson,
- String knownToolNamesJson,
- String workerCredJson) {
+ String knownToolNamesJson) {
return iife(" var httpCfg = " + httpConfigJson + ";" + " var mcpCfg = "
+ mcpConfigJson + ";" + " var mediaCfg = "
+ mediaConfigJson + ";" + " var agentToolCfg = "
@@ -536,7 +535,6 @@ public static String enrichToolsScript(
+ cliConfigJson + ";" + " var humanCfg = "
+ humanConfigJson + ";" + " var wmqCfg = "
+ wmqConfigJson + ";" + " var knownNames = " + knownToolNamesJson + ";"
- + " var workerCredCfg = " + workerCredJson + ";"
+ " var agentState = $.agentState || {};"
+ " var tcs = $.toolCalls || [];"
+ " var result = [];"
@@ -697,7 +695,6 @@ public static String enrichToolsScript(
+ " if (t.type === 'SIMPLE') {"
+ " t.inputParameters._agent_state = agentState;"
+ " if ($.agentspanCtx) { t.inputParameters.__agentspan_ctx__ = $.agentspanCtx; }"
- + " if (workerCredCfg[n]) { t.inputParameters.__resolved_credentials__ = workerCredCfg[n]; }"
+ " if (cliCfg[n]) { t.inputParameters._allowed_commands = cliCfg[n].allowedCommands; }"
+ " }"
+ " result.push(t);"
@@ -1155,8 +1152,7 @@ public static String enrichToolsScriptDynamic(
String ragConfigJson,
String humanConfigJson,
String wmqConfigJson,
- String knownToolNamesJson,
- String workerCredJson) {
+ String knownToolNamesJson) {
return iife(" var httpCfg = " + httpConfigJson + ";" + " var mcpCfg = $.mcpConfig || {};"
+ " var apiCfg = $.apiConfig || {};"
+ " var mediaCfg = "
@@ -1165,7 +1161,6 @@ public static String enrichToolsScriptDynamic(
+ ragConfigJson + ";" + " var humanCfg = "
+ humanConfigJson + ";" + " var wmqCfg = "
+ wmqConfigJson + ";" + " var knownNames = " + knownToolNamesJson + ";"
- + " var workerCredCfg = " + workerCredJson + ";"
+ " var agentState = $.agentState || {};"
+ " var tcs = $.toolCalls || [];"
+ " var result = [];"
@@ -1352,7 +1347,6 @@ public static String enrichToolsScriptDynamic(
+ " if (t.type === 'SIMPLE') {"
+ " t.inputParameters._agent_state = agentState;"
+ " if ($.agentspanCtx) { t.inputParameters.__agentspan_ctx__ = $.agentspanCtx; }"
- + " if (workerCredCfg[n]) { t.inputParameters.__resolved_credentials__ = workerCredCfg[n]; }"
+ " }"
+ " result.push(t);"
+ " }"
diff --git a/server/conductor-agentspan/src/test/java/dev/agentspan/runtime/compiler/ToolCompilerWorkerCredTest.java b/server/conductor-agentspan/src/test/java/dev/agentspan/runtime/compiler/ToolCompilerWorkerCredTest.java
deleted file mode 100644
index 16be2b08..00000000
--- a/server/conductor-agentspan/src/test/java/dev/agentspan/runtime/compiler/ToolCompilerWorkerCredTest.java
+++ /dev/null
@@ -1,126 +0,0 @@
-/*
- * Copyright (c) 2025 AgentSpan
- * Licensed under the MIT License.
- */
-package dev.agentspan.runtime.compiler;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-import java.util.List;
-import java.util.Map;
-
-import org.graalvm.polyglot.Context;
-import org.graalvm.polyglot.Value;
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.Test;
-
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.netflix.conductor.common.metadata.workflow.WorkflowTask;
-
-import dev.agentspan.runtime.model.AgentConfig;
-import dev.agentspan.runtime.model.ToolConfig;
-import dev.agentspan.runtime.util.EmbeddedMode;
-
-/**
- * Verifies EMBEDDED mode stamps {@code __resolved_credentials__ = { NAME: "${workflow.secrets.NAME}" }}
- * onto SIMPLE worker-tool tasks (via the enrich script), and that standalone / non-worker tools are
- * left untouched. In embedded, the host resolves the references from its secret store at poll time.
- */
-class ToolCompilerWorkerCredTest {
-
- private static final ObjectMapper MAPPER = new ObjectMapper();
-
- @AfterEach
- void resetEmbedded() {
- new EmbeddedMode().setEmbedded(false);
- }
-
- private static ToolConfig worker(String name, String... creds) {
- return ToolConfig.builder()
- .name(name)
- .description(name)
- .toolType("worker")
- .config(Map.of("credentials", List.of(creds)))
- .build();
- }
-
- private static ToolCompiler compilerFor(AgentConfig config) {
- ToolCompiler tc = new ToolCompiler();
- tc.setWorkerCreds(AgentCompiler.collectToolCredentials(config));
- return tc;
- }
-
- private static String enrichScript(ToolCompiler tc, List tools) {
- Object[] r = tc.buildEnrichTask("agent", "agent_llm", tools, "");
- return (String) ((WorkflowTask) r[0]).getInputParameters().get("expression");
- }
-
- /** Execute the enrich script through GraalJS for one tool call; return that task's built map. */
- @SuppressWarnings("unchecked")
- private static Map runEnrichForTool(String script, String toolName) throws Exception {
- String wrapped = "var $ = {toolCalls: [{name: '" + toolName + "', taskReferenceName: 'call_1',"
- + " inputParameters: {}}], agentState: {}, userPrompt: 'test'};"
- + " JSON.stringify(" + script + ");";
- try (Context ctx = Context.newBuilder("js").allowAllAccess(true).build()) {
- Value v = ctx.eval("js", wrapped);
- Map outer = MAPPER.readValue(v.asString(), Map.class);
- List> tasks = (List>) outer.get("dynamicTasks");
- return tasks.stream()
- .filter(t -> toolName.equals(t.get("name")))
- .findFirst()
- .orElseThrow();
- }
- }
-
- @Test
- void embedded_stampsPerToolSecretReference() {
- new EmbeddedMode().setEmbedded(true);
- ToolConfig gh = worker("gh", "GITHUB_TOKEN");
- AgentConfig config = AgentConfig.builder()
- .name("a")
- .model("openai/gpt-4o")
- .tools(List.of(gh))
- .build();
-
- String script = enrichScript(compilerFor(config), List.of(gh));
-
- assertThat(script).contains("\"gh\":{\"GITHUB_TOKEN\":\"${workflow.secrets.GITHUB_TOKEN}\"}");
- }
-
- @Test
- @SuppressWarnings("unchecked")
- void embedded_injectsResolvedCredentialsOntoSimpleTask() throws Exception {
- new EmbeddedMode().setEmbedded(true);
- ToolConfig gh = worker("gh", "GITHUB_TOKEN");
- AgentConfig config = AgentConfig.builder()
- .name("a")
- .model("openai/gpt-4o")
- .tools(List.of(gh))
- .build();
-
- Map task = runEnrichForTool(enrichScript(compilerFor(config), List.of(gh)), "gh");
-
- Map input = (Map) task.get("inputParameters");
- Map resolved = (Map) input.get("__resolved_credentials__");
- assertThat(resolved).containsEntry("GITHUB_TOKEN", "${workflow.secrets.GITHUB_TOKEN}");
- }
-
- @Test
- @SuppressWarnings("unchecked")
- void standalone_leavesWorkerTaskUntouched() throws Exception {
- new EmbeddedMode().setEmbedded(false);
- ToolConfig gh = worker("gh", "GITHUB_TOKEN");
- AgentConfig config = AgentConfig.builder()
- .name("a")
- .model("openai/gpt-4o")
- .tools(List.of(gh))
- .build();
-
- String script = enrichScript(compilerFor(config), List.of(gh));
- assertThat(script).doesNotContain("__resolved_credentials__\":{\"GITHUB_TOKEN");
-
- Map task = runEnrichForTool(script, "gh");
- Map input = (Map) task.get("inputParameters");
- assertThat(input).doesNotContainKey("__resolved_credentials__");
- }
-}
diff --git a/server/conductor-agentspan/src/test/java/dev/agentspan/runtime/compiler/WorkerRuntimeMetadataTest.java b/server/conductor-agentspan/src/test/java/dev/agentspan/runtime/compiler/WorkerRuntimeMetadataTest.java
new file mode 100644
index 00000000..380a371d
--- /dev/null
+++ b/server/conductor-agentspan/src/test/java/dev/agentspan/runtime/compiler/WorkerRuntimeMetadataTest.java
@@ -0,0 +1,246 @@
+/*
+ * Copyright (c) 2025 AgentSpan
+ * Licensed under the MIT License.
+ */
+package dev.agentspan.runtime.compiler;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.atLeastOnce;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+
+import com.netflix.conductor.common.metadata.tasks.TaskDef;
+import com.netflix.conductor.common.metadata.workflow.WorkflowTask;
+import com.netflix.conductor.dao.MetadataDAO;
+import com.netflix.conductor.service.MetadataService;
+
+import dev.agentspan.runtime.model.AgentConfig;
+import dev.agentspan.runtime.model.GuardrailConfig;
+import dev.agentspan.runtime.model.TerminationConfig;
+import dev.agentspan.runtime.model.ToolConfig;
+import dev.agentspan.runtime.service.AgentService;
+import dev.agentspan.runtime.util.EmbeddedMode;
+
+/**
+ * Target-state worker-secret delivery (conductor-oss PR #1255): in EMBEDDED mode the worker's
+ * {@link TaskDef} declares its secret names on {@code runtimeMetadata}; the host resolves them at the
+ * SIMPLE task's own poll and injects the values onto the wire-only {@code Task.runtimeMetadata} — the
+ * enrich script never stamps {@code __resolved_credentials__} into persisted task input. Standalone
+ * leaves {@code runtimeMetadata} empty (the native execution-token pull delivers secrets instead).
+ */
+class WorkerRuntimeMetadataTest {
+
+ @AfterEach
+ void resetEmbedded() {
+ new EmbeddedMode().setEmbedded(false);
+ }
+
+ private static ToolConfig worker(String name, String... creds) {
+ return ToolConfig.builder()
+ .name(name)
+ .description(name)
+ .toolType("worker")
+ .config(Map.of("credentials", List.of(creds)))
+ .build();
+ }
+
+ private static AgentConfig agentWith(ToolConfig tool) {
+ return AgentConfig.builder()
+ .name("a")
+ .model("openai/gpt-4o")
+ .tools(List.of(tool))
+ .build();
+ }
+
+ // ── The enrich script must NOT stamp __resolved_credentials__ (the retired interim) ──
+
+ @Test
+ void enrichScript_neverStampsResolvedCredentials_embedded() {
+ new EmbeddedMode().setEmbedded(true);
+ ToolConfig gh = worker("gh", "GITHUB_TOKEN");
+ Object[] r = new ToolCompiler().buildEnrichTask("agent", "agent_llm", List.of(gh), "");
+ String script = (String) ((WorkflowTask) r[0]).getInputParameters().get("expression");
+ assertThat(script).doesNotContain("__resolved_credentials__");
+ }
+
+ @Test
+ void enrichScript_neverStampsResolvedCredentials_standalone() {
+ new EmbeddedMode().setEmbedded(false);
+ ToolConfig gh = worker("gh", "GITHUB_TOKEN");
+ Object[] r = new ToolCompiler().buildEnrichTask("agent", "agent_llm", List.of(gh), "");
+ String script = (String) ((WorkflowTask) r[0]).getInputParameters().get("expression");
+ assertThat(script).doesNotContain("__resolved_credentials__");
+ }
+
+ // ── AgentService declares runtimeMetadata on the worker TaskDef only when embedded ──
+
+ @Test
+ void embedded_stampsRuntimeMetadataOnWorkerTaskDef() throws Exception {
+ new EmbeddedMode().setEmbedded(true);
+ TaskDef registered = registerWorkerTaskDef("gh", List.of("GITHUB_TOKEN"));
+ assertThat(registered.getRuntimeMetadata()).containsExactly("GITHUB_TOKEN");
+ }
+
+ @Test
+ void standalone_leavesRuntimeMetadataEmpty() throws Exception {
+ new EmbeddedMode().setEmbedded(false);
+ TaskDef registered = registerWorkerTaskDef("gh", List.of("GITHUB_TOKEN"));
+ assertThat(registered.getRuntimeMetadata()).isNullOrEmpty();
+ }
+
+ @Test
+ void collectToolCredentials_mapsWorkerToItsSecretNames() {
+ AgentConfig config = agentWith(worker("gh", "GITHUB_TOKEN", "GH_APP_ID"));
+ Map> creds = AgentCompiler.collectToolCredentials(config);
+ assertThat(creds.get("gh")).containsExactlyInAnyOrder("GITHUB_TOKEN", "GH_APP_ID");
+ }
+
+ // ── Agent-level creds feed the non-worker user-code task defs (guardrail/callback/etc.) ──
+
+ @Test
+ void collectAgentCredentials_returnsDedupedOrdered() {
+ AgentConfig config = AgentConfig.builder()
+ .name("a")
+ .model("openai/gpt-4o")
+ .credentials(List.of("A", "B", "A"))
+ .build();
+ assertThat(AgentCompiler.collectAgentCredentials(config)).containsExactly("A", "B");
+ }
+
+ @Test
+ void collectAgentCredentials_emptyWhenNoneDeclared() {
+ AgentConfig config =
+ AgentConfig.builder().name("a").model("openai/gpt-4o").build();
+ assertThat(AgentCompiler.collectAgentCredentials(config)).isEmpty();
+ }
+
+ /**
+ * Wiring test: embedded, {@code collectAndRegisterTasks} must declare the agent-level creds on a
+ * custom-guardrail worker's {@link TaskDef} (user code → needs secrets), but leave the declarative
+ * {@code _termination} def empty (no user function runs there). Fails until agent-level creds are
+ * threaded into the guardrail registration site.
+ */
+ @Test
+ void embedded_declaresAgentCredsOnGuardrailButNotTermination() throws Exception {
+ new EmbeddedMode().setEmbedded(true);
+ AgentConfig config = AgentConfig.builder()
+ .name("a")
+ .model("openai/gpt-4o")
+ .credentials(List.of("DEMO_SECRET"))
+ .guardrails(List.of(GuardrailConfig.builder()
+ .guardrailType("custom")
+ .taskName("a_guard")
+ .build()))
+ .termination(TerminationConfig.builder().build())
+ .build();
+
+ Map defs = registerAllTaskDefs(config);
+
+ assertThat(defs.get("a_guard").getRuntimeMetadata()).containsExactly("DEMO_SECRET");
+ assertThat(defs.get("a_termination").getRuntimeMetadata()).isNullOrEmpty();
+ }
+
+ @Test
+ void standalone_leavesNonWorkerRuntimeMetadataEmpty() throws Exception {
+ new EmbeddedMode().setEmbedded(false);
+ AgentConfig config = AgentConfig.builder()
+ .name("a")
+ .model("openai/gpt-4o")
+ .credentials(List.of("DEMO_SECRET"))
+ .guardrails(List.of(GuardrailConfig.builder()
+ .guardrailType("custom")
+ .taskName("a_guard")
+ .build()))
+ .build();
+
+ Map defs = registerAllTaskDefs(config);
+
+ assertThat(defs.get("a_guard").getRuntimeMetadata()).isNullOrEmpty();
+ }
+
+ /**
+ * Drive {@link AgentService}'s private {@code registerTaskDefinitions(AgentConfig)} and return every
+ * {@link TaskDef} handed to {@code MetadataService.registerTaskDef}, keyed by task name — so a test
+ * can assert per-task-kind {@code runtimeMetadata}.
+ */
+ private static Map registerAllTaskDefs(AgentConfig config) throws Exception {
+ MetadataDAO metadataDAO = mock(MetadataDAO.class);
+ MetadataService metadataService = mock(MetadataService.class);
+
+ AgentService service = new AgentService(
+ mock(dev.agentspan.runtime.compiler.AgentCompiler.class),
+ mock(dev.agentspan.runtime.normalizer.NormalizerRegistry.class),
+ mock(com.netflix.conductor.dao.ExecutionDAO.class),
+ metadataDAO,
+ mock(com.netflix.conductor.core.execution.WorkflowExecutor.class),
+ mock(com.netflix.conductor.service.WorkflowService.class),
+ mock(dev.agentspan.runtime.service.AgentStreamRegistry.class),
+ mock(com.netflix.conductor.service.ExecutionService.class),
+ mock(dev.agentspan.runtime.util.ProviderValidator.class));
+
+ Field msField = AgentService.class.getDeclaredField("metadataService");
+ msField.setAccessible(true);
+ msField.set(service, metadataService);
+
+ Method m = AgentService.class.getDeclaredMethod("registerTaskDefinitions", AgentConfig.class);
+ m.setAccessible(true);
+ m.invoke(service, config);
+
+ @SuppressWarnings("unchecked")
+ ArgumentCaptor> captor = ArgumentCaptor.forClass(List.class);
+ verify(metadataService, atLeastOnce()).registerTaskDef(captor.capture());
+ Map byName = new HashMap<>();
+ for (List batch : captor.getAllValues()) {
+ for (TaskDef def : batch) {
+ byName.put(def.getName(), def);
+ }
+ }
+ return byName;
+ }
+
+ /**
+ * Drive {@link AgentService}'s private {@code registerTaskDef(String, List)} with the credential
+ * names {@link AgentCompiler#collectToolCredentials} yields for {@code toolName}, and capture the
+ * {@link TaskDef} handed to {@code MetadataService.registerTaskDef}.
+ */
+ private static TaskDef registerWorkerTaskDef(String toolName, List creds) throws Exception {
+ MetadataDAO metadataDAO = mock(MetadataDAO.class);
+ MetadataService metadataService = mock(MetadataService.class);
+ when(metadataDAO.getTaskDef(toolName)).thenReturn(null);
+
+ AgentService service = new AgentService(
+ mock(dev.agentspan.runtime.compiler.AgentCompiler.class),
+ mock(dev.agentspan.runtime.normalizer.NormalizerRegistry.class),
+ mock(com.netflix.conductor.dao.ExecutionDAO.class),
+ metadataDAO,
+ mock(com.netflix.conductor.core.execution.WorkflowExecutor.class),
+ mock(com.netflix.conductor.service.WorkflowService.class),
+ mock(dev.agentspan.runtime.service.AgentStreamRegistry.class),
+ mock(com.netflix.conductor.service.ExecutionService.class),
+ mock(dev.agentspan.runtime.util.ProviderValidator.class));
+
+ Field msField = AgentService.class.getDeclaredField("metadataService");
+ msField.setAccessible(true);
+ msField.set(service, metadataService);
+
+ Method m = AgentService.class.getDeclaredMethod("registerTaskDef", String.class, List.class);
+ m.setAccessible(true);
+ m.invoke(service, toolName, creds);
+
+ @SuppressWarnings("unchecked")
+ ArgumentCaptor> captor = ArgumentCaptor.forClass(List.class);
+ verify(metadataService).registerTaskDef(captor.capture());
+ return captor.getValue().get(0);
+ }
+}