fix: apply runtime input defaults in entrypoint

Signed-off-by: zebbern <185730623+zebbern@users.noreply.github.com>

Author: zebbern

worker/src/components/core/__tests__/entry-point.test.ts

@@ -136,6 +136,68 @@ describe('entry-point component', () => {
     });
   });
 
+  it('should preserve and apply runtime input default values after parameter parsing', async () => {
+    const component = componentRegistry.get<EntryPointInput, EntryPointOutput>(
+      'core.workflow.entrypoint',
+    );
+    if (!component) throw new Error('Component not registered');
+
+    const context = createExecutionContext({
+      runId: 'test-run',
+      componentRef: 'trigger-test',
+    });
+
+    const parsedParams = component.parameters!.parse({
+      runtimeInputs: [
+        {
+          id: 'outOfScopePaths',
+          label: 'Out-of-scope paths',
+          type: 'array',
+          required: false,
+          defaultValue: [],
+        },
+        {
+          id: 'previousSnapshot',
+          label: 'Previous snapshot',
+          type: 'json',
+          required: false,
+          defaultValue: { hosts: [], endpoints: [], findings: [] },
+        },
+        {
+          id: 'includeLowSeverity',
+          label: 'Include low severity',
+          type: 'boolean',
+          required: false,
+          defaultValue: false,
+        },
+        {
+          id: 'targetLimit',
+          label: 'Target limit',
+          type: 'number',
+          required: false,
+          defaultValue: 10,
+        },
+      ],
+    });
+
+    const result = (await component.execute(
+      {
+        inputs: {
+          __runtimeData: {},
+        },
+        params: parsedParams,
+      },
+      context,
+    )) as Record<string, unknown>;
+
+    expect(result).toEqual({
+      outOfScopePaths: [],
+      previousSnapshot: { hosts: [], endpoints: [], findings: [] },
+      includeLowSeverity: false,
+      targetLimit: 10,
+    });
+  });
+
   it('should throw when required runtime input is missing', async () => {
     const component = componentRegistry.get<EntryPointInput, EntryPointOutput>(
       'core.workflow.entrypoint',

worker/src/components/core/entry-point.ts

@@ -34,6 +34,7 @@ const runtimeInputDefinitionSchema = z.preprocess(
       .describe('Type of input data'),
     required: z.boolean().default(true).describe('Whether this input is required'),
     description: z.string().optional().describe('Help text for the input'),
+    defaultValue: z.unknown().optional().describe('Default value to use when input is omitted'),
   }),
 );
 
@@ -143,33 +144,42 @@ const definition = defineComponent({
 
     for (const inputDef of runtimeInputs) {
       const value = __runtimeData?.[inputDef.id];
+      const hasValue = value !== undefined && value !== null;
+      const hasDefaultValue =
+        Object.prototype.hasOwnProperty.call(inputDef, 'defaultValue') &&
+        inputDef.defaultValue !== undefined &&
+        inputDef.defaultValue !== null;
+      let outputValue = value;
+
+      if (!hasValue && hasDefaultValue) {
+        outputValue = inputDef.defaultValue;
+      }
 
-      if (inputDef.required && (value === undefined || value === null)) {
+      if (inputDef.required && outputValue === undefined) {
         throw new ValidationError(
           `Required runtime input '${inputDef.label}' (${inputDef.id}) was not provided`,
           {
             fieldErrors: { [inputDef.id]: ['This field is required'] },
           },
         );
       }
-      // Optional text inputs default to empty string so downstream script ports receive
-      // a defined value instead of failing input validation / retrying indefinitely.
-      if (
-        (value === undefined || value === null) &&
-        !inputDef.required &&
-        inputDef.type === 'text'
-      ) {
-        outputs[inputDef.id] = '';
-      } else {
-        outputs[inputDef.id] = value;
+
+      if (outputValue === undefined && !inputDef.required) {
+        if (inputDef.type === 'text') {
+          // Optional text inputs default to empty string so downstream script ports receive
+          // a defined value instead of failing input validation / retrying indefinitely.
+          outputValue = '';
+        }
       }
+
+      outputs[inputDef.id] = outputValue;
       // Mask secret values in logs
       const logValue =
         inputDef.type === 'secret'
           ? '***'
-          : typeof value === 'object'
-            ? JSON.stringify(value)
-            : value;
+          : typeof outputValue === 'object'
+            ? JSON.stringify(outputValue)
+            : outputValue;
       context.logger.info(`[EntryPoint] Output '${inputDef.id}' = ${logValue}`);
     }