[One Workflow] Step registry completion context enhancement (elastic#260054)

## Summary

issue: elastic/security-team#15982. (Resolves
requirement #2)

Enriches `SelectionContext` with step `values` so that
`PropertySelectionHandler` implementations (`search`, `resolve`,
`getDetails`) can access sibling property values from the current step
definition.

There are no existing steps using `context.values` yet — this is a
prerequisite for upcoming steps from the Cases team that need to read
sibling properties (e.g. `owner`) to scope their search/resolve logic.


### What changed

**`SelectionContext.values`** — A new `values` field (`{ config, input
}`) is populated from the step's YAML properties at the time
`search`/`resolve`/`getDetails` are called. Handlers can now read
sibling values like `context.values.input.owner` instead of having no
visibility into the rest of the step.

**YAML value extraction fix** — `getValueFromValueNode` now handles
non-scalar YAML nodes (arrays/sequences) via `.toJSON()`, fixing a bug
where array properties like `owner: [securitySolution]` appeared as
`undefined` in `context.values`.

**Example** — An example has been implemented in the
`examples.externalStep` from the _workflows_examples_ plugin (test with
`node scripts/kibana --dev --run-examples`)

### Demo


https://github.com/user-attachments/assets/b0cf18ae-5906-4561-bf5e-31b228b08a30

### Files changed

| Area | Files | Change |
|------|-------|--------|
| Shared types | `kbn-workflows/types/v1.ts`, `latest.ts` | Added
`StepSelectionValues` interface, `values` field on `SelectionContext`,
generic type parameters on 4 interfaces |
| Step registry | `workflows_extensions/.../step_registry/types.ts` |
Thread `Config`/`Input` schema types into `StepPropertyHandler` for
automatic inference |
| Value builder | `build_workflow_lookup.ts` | Added
`buildStepSelectionValues()` helper + fixed `getValueFromValueNode` for
non-scalar nodes |
| Context wiring | `collect_all_custom_property_items.ts`,
`get_custom_property_suggestions.ts` | Pass `values` when constructing
`SelectionContext` |
| Docs | `STEPS.md` | Updated `SelectionContext` type definition and
documented `context.values` |
| Tests | `build_workflow_lookup.test.ts`,
`validate_custom_properties.test.ts`,
`get_custom_property_suggestions.test.ts` | New tests for value building
(including arrays), updated assertions for new context shape |

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

Author: semd

examples/workflows_extensions_example/common/step_types/external_step.ts

@@ -41,6 +41,7 @@ export const ConfigSchema = z.object({
   proxy: z.object({
     id: z.string(),
     url: z.string().optional(),
+    ssl: z.boolean().optional().describe('When true, only HTTPS proxies are shown'),
   }),
 });
 

examples/workflows_extensions_example/public/plugin.ts

@@ -69,6 +69,7 @@ export class WorkflowsExtensionsExamplePlugin
         'my-third-proxy': { name: 'Development Proxy', url: 'https://example.com/third' },
         'my-fourth-proxy': { name: 'Testing Proxy', url: 'https://example.com/fourth' },
         'my-fifth-proxy': { name: 'Backup Proxy', url: 'https://example.com/fifth' },
+        'my-sixth-proxy': { name: 'HTTP Proxy', url: 'http://example.com/sixth' },
       }),
     });
     registerTriggerDefinitions(plugins.workflowsExtensions);

examples/workflows_extensions_example/public/step_types/external_step.ts

@@ -22,40 +22,55 @@ export const getExternalStepDefinition = (deps: { externalService: IExampleExter
       config: {
         'proxy.id': {
           selection: {
-            search: async (input, _context) => {
+            search: async (input, context) => {
               const proxies = await deps.externalService.getProxies();
               const inputTrimmed = input.trim();
+              const sslOnly = context.values.config.proxy?.ssl === true;
               return proxies
-                .filter(
-                  (proxy) =>
+                .filter((proxy) => {
+                  if (sslOnly && !proxy.url.startsWith('https://')) return false;
+                  return (
                     inputTrimmed.length === 0 ||
                     proxy.id.includes(inputTrimmed) ||
                     proxy.name.toLowerCase().includes(inputTrimmed.toLowerCase())
-                )
+                  );
+                })
                 .map((proxy) => ({
                   value: proxy.id,
                   label: proxy.name,
                   description: 'URL: ' + proxy.url,
                 }));
             },
-            resolve: async (value, _context) => {
+            resolve: async (value, context) => {
               const proxy = await deps.externalService.getProxy(value);
               if (!proxy) {
                 return null;
               }
+              const sslOnly = context.values.config.proxy?.ssl === true;
+              if (sslOnly && !proxy.url.startsWith('https://')) {
+                return null;
+              }
               return {
                 value: proxy.id,
                 label: proxy.name,
                 description: 'URL: ' + proxy.url,
               };
             },
-            getDetails: async (value, _context, option) => {
+            getDetails: async (value, context, option) => {
               if (option) {
                 return {
                   message: `Proxy "${option.label}" is connected`,
                   links: [{ text: 'Manage proxies', path: 'https://example.com/proxies' }],
                 };
               }
+              const sslOnly = context.values.config.proxy?.ssl === true;
+              const proxy = await deps.externalService.getProxy(value);
+              if (proxy && sslOnly && !proxy.url.startsWith('https://')) {
+                return {
+                  message: `Proxy "${proxy.name}" uses HTTP but proxy.ssl is enabled. Select an HTTPS proxy or set proxy.ssl to false.`,
+                  links: [{ text: 'Manage proxies', path: 'https://example.com/proxies' }],
+                };
+              }
               return {
                 message: `Proxy "${value}" not found. Please select an existing proxy or create a new one.`,
                 links: [

src/platform/packages/shared/kbn-workflows/types/latest.ts

@@ -64,6 +64,7 @@ export type {
   SelectionOption,
   SelectionDetails,
   SelectionContext,
+  StepSelectionValues,
   RequestOptions,
   GetAvailableConnectorsResponse,
 } from './v1';

src/platform/packages/shared/kbn-workflows/types/v1.ts

@@ -503,12 +503,16 @@ export interface InternalConnectorContract extends BaseConnectorContract {
   };
 }
 
-export interface StepPropertyHandler<T = unknown> {
+export interface StepPropertyHandler<
+  T = unknown,
+  TConfig extends Record<string, unknown> = Record<string, unknown>,
+  TInput extends Record<string, unknown> = Record<string, unknown>
+> {
   /**
    * Entity selection configuration for the property.
    * Provides a unified interface for search, resolution, and decoration of entity references.
    */
-  selection?: PropertySelectionHandler<Exclude<T, undefined>>;
+  selection?: PropertySelectionHandler<Exclude<T, undefined>, TConfig, TInput>;
   /**
    * Connector ID selection configuration for the property.
    * Used to resolve connector IDs for custom steps.
@@ -518,19 +522,29 @@ export interface StepPropertyHandler<T = unknown> {
   connectorIdSelection?: ConnectorIdSelectionHandler;
 }
 
-export interface PropertySelectionHandler<T = unknown> {
+export interface PropertySelectionHandler<
+  T = unknown,
+  TConfig extends Record<string, unknown> = Record<string, unknown>,
+  TInput extends Record<string, unknown> = Record<string, unknown>
+> {
   /**
    * Search for options matching the input query.
    * Used by autocomplete dropdowns when the user types.
    */
-  search: (input: string, context: SelectionContext) => Promise<SelectionOption<T>[]>;
+  search: (
+    input: string,
+    context: SelectionContext<TConfig, TInput>
+  ) => Promise<SelectionOption<T>[]>;
 
   /**
    * Resolve an entity by its value.
    * Used when loading existing values or when a value is pasted.
    * Returns null if the entity is not found.
    */
-  resolve: (value: T, context: SelectionContext) => Promise<SelectionOption<T> | null>;
+  resolve: (
+    value: T,
+    context: SelectionContext<TConfig, TInput>
+  ) => Promise<SelectionOption<T> | null>;
 
   /**
    * Get detailed information for the current value.
@@ -539,7 +553,7 @@ export interface PropertySelectionHandler<T = unknown> {
    */
   getDetails: (
     input: string,
-    context: SelectionContext,
+    context: SelectionContext<TConfig, TInput>,
     option: SelectionOption<T> | null
   ) => Promise<SelectionDetails>;
 }
@@ -567,13 +581,35 @@ export interface SelectionDetails {
   }>;
 }
 
-export interface SelectionContext {
+/**
+ * Structured values of the current step, split by scope.
+ *
+ * Built from scalar leaf properties in the YAML step definition.
+ * Intermediate map nodes that have no scalar value are **not** represented;
+ * a missing key means "not yet defined in the YAML", not "empty object".
+ */
+export interface StepSelectionValues<
+  TConfig extends Record<string, unknown> = Record<string, unknown>,
+  TInput extends Record<string, unknown> = Record<string, unknown>
+> {
+  /** Root-level step properties (everything outside the `with` block). */
+  config: TConfig;
+  /** Properties nested under the `with` block. */
+  input: TInput;
+}
+
+export interface SelectionContext<
+  TConfig extends Record<string, unknown> = Record<string, unknown>,
+  TInput extends Record<string, unknown> = Record<string, unknown>
+> {
   /** The step type ID (e.g., "onechat.runAgent") */
   stepType: string;
   /** The property path ("config" or "input") */
   scope: 'config' | 'input';
   /** The property key (e.g., "agent_id") */
   propertyKey: string;
+  /** Sibling values of the current step, keyed by scope. */
+  values: StepSelectionValues<TConfig, TInput>;
 }
 
 export interface ConnectorIdSelectionHandler {

src/platform/plugins/shared/workflows_extensions/dev_docs/STEPS.md

@@ -427,16 +427,29 @@ interface SelectionDetails {
   }>;
 }
 
+interface StepSelectionValues {
+  /** Root-level step properties (everything outside the `with` block). */
+  config: Record<string, unknown>;
+  /** Properties nested under the `with` block. */
+  input: Record<string, unknown>;
+}
+
 interface SelectionContext {
   /** The step type ID (e.g., "ai.runAgent", "one-chat.invoke") */
   stepType: string;
   /** The property scope ("config" or "input") */
   scope: 'config' | 'input';
   /** The property key (e.g., "agent-id") */
   propertyKey: string;
+  /** Sibling values of the current step, keyed by scope. */
+  values: StepSelectionValues;
 }
 ```
 
+`context.values` gives handlers access to the current step's other property values.
+For example, if the YAML step has `with: { owner: securitySolution }`, the handler
+can read `context.values.input.owner`. Missing properties are `undefined`.
+
 #### Example Implementation
 
 For a complete working example, see the `external_step` implementation in `examples/workflows_extensions_example`:

src/platform/plugins/shared/workflows_extensions/public/step_registry/types.ts

@@ -59,18 +59,32 @@ export interface EditorHandlers<
   Output extends z.ZodType = z.ZodType,
   Config extends z.ZodObject = z.ZodObject
 > {
-  config?: EditorHandlersConfig<Config>;
-  input?: EditorHandlersInput<Input>;
+  config?: EditorHandlersConfig<Config, Input>;
+  input?: EditorHandlersInput<Input, Config>;
   dynamicSchema?: DynamicSchema<Input, Output, Config>;
 }
 
-export type EditorHandlersConfig<Config extends z.ZodObject = z.ZodObject> = {
-  [K in DotKeysOf<z.infer<Config>>]?: StepPropertyHandler<DotObject<z.infer<Config>>[K]>;
+export type EditorHandlersConfig<
+  Config extends z.ZodObject = z.ZodObject,
+  Input extends z.ZodType = z.ZodType
+> = {
+  [K in DotKeysOf<z.infer<Config>>]?: StepPropertyHandler<
+    DotObject<z.infer<Config>>[K],
+    z.infer<Config>,
+    Input extends z.ZodObject ? z.infer<Input> : Record<string, unknown>
+  >;
 };
 
-export type EditorHandlersInput<Input extends z.ZodType = z.ZodType> = Input extends z.ZodObject
+export type EditorHandlersInput<
+  Input extends z.ZodType = z.ZodType,
+  Config extends z.ZodObject = z.ZodObject
+> = Input extends z.ZodObject
   ? {
-      [K in DotKeysOf<z.infer<Input>>]?: StepPropertyHandler<DotObject<z.infer<Input>>[K]>;
+      [K in DotKeysOf<z.infer<Input>>]?: StepPropertyHandler<
+        DotObject<z.infer<Input>>[K],
+        z.infer<Config>,
+        z.infer<Input>
+      >;
     }
   : {};
 

src/platform/plugins/shared/workflows_management/public/entities/workflows/store/workflow_detail/utils/build_workflow_lookup.test.ts

@@ -8,7 +8,12 @@
  */
 
 import { LineCounter, parseDocument } from 'yaml';
-import { buildWorkflowLookup, getValueFromValueNode, inspectStep } from './build_workflow_lookup';
+import {
+  buildStepSelectionValues,
+  buildWorkflowLookup,
+  getValueFromValueNode,
+  inspectStep,
+} from './build_workflow_lookup';
 
 describe('inspectStep', () => {
   describe('simple step parsing', () => {
@@ -589,3 +594,68 @@ steps:
     expect(result.steps.step1.stepType).toBe('console');
   });
 });
+
+describe('buildStepSelectionValues', () => {
+  function getStep(yaml: string): ReturnType<typeof inspectStep>[string] {
+    const lineCounter = new LineCounter();
+    const yamlDocument = parseDocument(yaml, { lineCounter, keepSourceTokens: true });
+    const stepsNode = (yamlDocument.contents as any).get('steps');
+    const steps = inspectStep(stepsNode, lineCounter);
+    return Object.values(steps)[0];
+  }
+
+  it('should split config and input from step properties', () => {
+    const step = getStep(`
+steps:
+  - name: s1
+    type: my.step
+    connector-id: abc
+    with:
+      owner: securitySolution
+      message: hello
+`);
+    const values = buildStepSelectionValues(step);
+    expect(values.config).toEqual({ 'connector-id': 'abc' });
+    expect(values.input).toEqual({ owner: 'securitySolution', message: 'hello' });
+  });
+
+  it('should handle nested with paths', () => {
+    const step = getStep(`
+steps:
+  - name: s1
+    type: my.step
+    with:
+      inputs:
+        field1: value1
+        field2: value2
+`);
+    const values = buildStepSelectionValues(step);
+    expect(values.config).toEqual({});
+    expect(values.input).toEqual({ inputs: { field1: 'value1', field2: 'value2' } });
+  });
+
+  it('should handle array values under with', () => {
+    const step = getStep(`
+steps:
+  - name: s1
+    type: my.step
+    with:
+      field1:
+        - value1
+        - value2
+`);
+    const values = buildStepSelectionValues(step);
+    expect(values.input).toEqual({ field1: ['value1', 'value2'] });
+  });
+
+  it('should return empty objects when step has no custom properties', () => {
+    const step = getStep(`
+steps:
+  - name: s1
+    type: my.step
+`);
+    const values = buildStepSelectionValues(step);
+    expect(values.config).toEqual({});
+    expect(values.input).toEqual({});
+  });
+});