fix(automation): recognize inline config.script so it isn't flagged as an empty no-op (#1870)

CI Build Core caught that the build-time check (and the runtime executor) treated
a `script` node carrying inline JS in `config.script` as target-less, breaking
example-crm/showcase builds. Inline `config.script` is a distinct, recognized
form — the built-in runtime has no server-side JS sandbox so it does NOT execute
it (a separate gap, out of #1870's callable-resolution scope). Now:

- build validation accepts `function` | `actionType` | non-empty `script`;
- the runtime executor warns loudly that inline scripts aren't executed (and
  points to `defineStack({ functions })`) instead of failing the step or
  silently succeeding.

Verified example-crm, app-showcase, app-todo all build clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: os-zhuang

packages/cli/src/utils/validate-expressions.test.ts

@@ -92,6 +92,7 @@ describe('validateStackExpressions (ADR-0032 build-time)', () => {
           { id: 'start', type: 'start', config: {} },
           { id: 'mail', type: 'script', config: { actionType: 'email' } },
           { id: 'triage', type: 'script', config: { function: 'helpdesk.aiTriageStub' } },
+          { id: 'inline', type: 'script', config: { script: 'variables.x = 1;' } },
         ],
         edges: [],
       }],

packages/cli/src/utils/validate-expressions.ts

@@ -86,7 +86,11 @@ export function validateStackExpressions(stack: AnyRec): ExprIssue[] {
       if (node.type === 'script') {
         const fn = typeof cfg.function === 'string' ? cfg.function.trim() : '';
         const action = typeof cfg.actionType === 'string' ? cfg.actionType.trim() : '';
-        if (!fn && !action) {
+        // Inline `config.script` (a JS body) is also a declared form — the
+        // built-in runtime doesn't execute it (warned at run time), but the node
+        // is not the empty no-op this check targets, so don't flag it.
+        const inline = typeof cfg.script === 'string' ? cfg.script.trim() : '';
+        if (!fn && !action && !inline) {
           issues.push({
             where: `flow '${flowName}' · node '${node.id}' (script) callable`,
             message:

packages/services/service-automation/src/builtin/screen-nodes.test.ts

@@ -86,6 +86,13 @@ describe('script node (#1870 — callable resolution)', () => {
         expect(result.error).toMatch(/no function named|not a built-in/i);
     });
 
+    it('recognizes inline config.script as a no-op (not a loud failure) — built-in runtime has no JS sandbox', async () => {
+        engine.registerFlow('script_flow', scriptFlow({ script: 'variables.x = 1;', outputVariables: ['x'] }));
+        const result = await engine.execute('script_flow', {} as any);
+        // Recognized form: succeeds (doesn't fail loud), but is documented as not executed.
+        expect(result.success).toBe(true);
+    });
+
     it('FAILS LOUDLY when the script node declares no target at all (actionType: undefined repro)', async () => {
         engine.registerFlow('script_flow', scriptFlow({ actionType: undefined }));
         const result = await engine.execute('script_flow', {} as any);

packages/services/service-automation/src/builtin/screen-nodes.ts

@@ -102,6 +102,22 @@ export function registerScreenNodes(engine: AutomationEngine, ctx: PluginContext
           };
         }
 
+        // Inline `config.script` (a JS source body) is a distinct, recognized
+        // form — but the built-in runtime has no server-side JS sandbox, so it
+        // does not execute it. Warn loudly (not a silent success) and steer the
+        // author to the supported path — a registered function — rather than
+        // failing the flow. Executing inline scripts is a separate capability,
+        // out of #1870's callable-resolution scope.
+        const inlineScript = typeof cfg.script === 'string' && cfg.script.trim() ? cfg.script : undefined;
+        if (!fnName && inlineScript) {
+          ctx.logger.warn(
+            `[Script] node '${node.id}': inline \`config.script\` is not executed by the built-in runtime ` +
+              `(no server-side JS sandbox) — this node is a no-op. To run server logic, move it into a ` +
+              `registered function and call it via \`config.function\` + \`defineStack({ functions })\`.`,
+          );
+          return { success: true, output: { script: 'not-executed' } };
+        }
+
         // Otherwise the node names a function to invoke. `function` is canonical;
         // a bare `actionType` that matched no built-in is accepted as a shorthand
         // function name (so templates that point a node straight at e.g.

packages/spec/src/automation/flow.zod.ts

@@ -34,8 +34,10 @@ export const FlowNodeAction = z.enum([
   'notify',             // Outbound notification (ADR-0012) — dispatched via the messaging service
   'script',             // Custom action: a built-in side-effect (`config.actionType: 'email'|'slack'`)
                         //   or a registered function (`config.function: 'name'` + `config.inputs`),
-                        //   resolved from `defineStack({ functions })`. An empty script node is
-                        //   rejected at build/registration and fails loudly at run time (#1870).
+                        //   resolved from `defineStack({ functions })`. (Inline `config.script` JS is
+                        //   recognized but NOT executed by the built-in runtime — no server-side
+                        //   sandbox.) A script node naming none of these is flagged at build and
+                        //   fails loudly at run time (#1870).
   'screen',             // Screen / User-Input Element
   'wait',               // Delay/Sleep
   'subflow',            // Call another flow