Conversation
Introduce @ai-di/temporal-payload-codec so workers and clients compress workflow payloads consistently while preserving inner encoding metadata.
Add @ai-di/graph-workflow-config for computeConfigHash and applyWorkflowConfigOverrides, wired from temporal and backend-services.
Store large OCR JSON in blob storage and pass OcrPayloadRef through activities; add jest setup for activity logger mocks.
Read and write OCR payloads via OcrPayloadRef in poll, extract, enrich, cleanup, confidence, mistral, and post-OCR correction activities.
graphWorkflow resolves config via activity by versionId and configHash; wire gzip payload codec on worker; slim child workflow args and results.
Benchmark sample workflows pass workflowVersionId, configHash, and groupId; materialize dataset returns groupId for synthetic documents.
Temporal client starts graphWorkflow with workflowVersionId, merged configHash, and overrides; benchmark and ground-truth paths aligned.
CLI migrates workflow configs to ocrResponseRef/ocrResultRef keys; seed and template JSON updated for ref-based ctx ports.
Align workflow integration test scripts and starter with versioned graphWorkflow input (workflowVersionId and configHash).
kmandryk
requested review from
NoorChasib,
alex-struk,
antsand and
dbarkowsky
as code owners
June 4, 2026 19:28
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Reject unsafe dot-path segments to prevent prototype pollution when applying workflow config overrides. Add a UNSAFE_PATH_SEGMENTS check and assertSafePathSegments in packages/graph-workflow-config, call it from setNestedValue, and tighten property checks using Object.prototype.hasOwnProperty.call. Add unit tests in apps/backend-services to ensure __proto__ and constructor segments are rejected. Update docs to document the security behavior and note that benchmark APIs further whitelist overrides against exposedParams.
Harden applyWorkflowConfigOverrides against prototype pollution and invalid path segments. Replace JSON.parse-based cloning with deepCloneToNullPrototype to produce null-prototype objects, so nested assignments cannot reach Object.prototype. Add SAFE_PATH_SEGMENT regex and isSafeOverridePathSegment to validate dot-path segments (reject blocklisted names, empty segments, and non-identifier segments), and update assertSafePathSegments to use it. Make setNestedValue create null-prototype objects for intermediate nodes. Update tests to use Object.hasOwn and add a test rejecting non-identifier segments; update docs to reflect the stricter rules.
dbarkowsky
approved these changes
Jun 8, 2026
dbarkowsky
left a comment
dbarkowsky
left a comment
Collaborator
There was a problem hiding this comment.
No large concerns. Up to you if you want to fix that Copilot-found error and the one issue I noted.
…function' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Treat failed Azure OCR responses as non-retryable Temporal failures. Add ApplicationFailure import and a throwFailedOcrResponse helper that builds an ApplicationFailure with a descriptive message (including error code/message) and includes the OCR response in details. Replace previous 'failed' return branches with this helper and update tests to expect ApplicationFailure with nonRetryable=true and the response details.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Optimize temporal db storage to avoid bloat
AI-1264
Changes
Testing
Checklist
By submitting this pull request, I acknowledge that I have attempted to meet the following: