feat: connect orchestrator and frontend

[Scra3]

MAIN BRANCH TO INTRODUCE WORKFLOW EXECUTOR.

Note

Connect workflow orchestrator to frontend via a new workflow-executor package and agent proxy routes

• Introduces @forestadmin/workflow-executor, a standalone service that polls the Forest server for pending workflow runs and executes them step-by-step using AI-driven executors for condition, read-record, update-record, trigger-action, load-related-record, MCP, and guidance step types.
• Adds a Koa HTTP server (ExecutorHttpServer) exposing /health, GET /runs/:runId, and POST /runs/:runId/trigger so the frontend can query step state and submit pending-data confirmations.
• Adds WorkflowExecutorProxyRoute to the agent, which forwards /_internal/workflow-executions/:runId (GET/POST) to the configured workflowExecutorUrl; the route is registered only when workflowExecutorUrl is set in agent options.
• Adds persistence adapters including an in-memory store and a SQLite/Postgres DatabaseStore (with Umzug migrations), plus activity-log, agent-client, and AI-proxy adapters with retry logic.
• Extracts AiClient, createBaseChatModel, and getAiConfiguration into @forestadmin/ai-proxy and exports LangChain types, enabling the executor to support both external AI configs and a server-routed AI proxy.
• Risk: the agent now exposes unauthenticated-at-the-agent-level proxy routes under /_internal/workflow-executions/; access control relies on JWT middleware inside the executor HTTP server.

^{Macroscope summarized 2b7a1b5.}

[macroscopeapp]

🟡 Medium adapters/forest-server-workflow-port.ts:134

In toMalformedInfo, accessing run.workflowHistory.at(-1) throws TypeError: Cannot read properties of undefined (reading 'at') when workflowHistory is null or undefined. Since this method is only called from error handlers during malformed run recovery, a missing workflowHistory causes the error handling itself to crash. Consider guarding the access with optional chaining: run.workflowHistory?.at(-1).

Suggested change

	const pending = run.workflowHistory.at(-1) ?? null;
	const pending = run.workflowHistory?.at(-1) ?? null;

🚀 Reply "fix it for me" or copy this AI Prompt for your agent:

In file packages/workflow-executor/src/adapters/forest-server-workflow-port.ts around line 134:

In `toMalformedInfo`, accessing `run.workflowHistory.at(-1)` throws `TypeError: Cannot read properties of undefined (reading 'at')` when `workflowHistory` is `null` or `undefined`. Since this method is only called from error handlers during malformed run recovery, a missing `workflowHistory` causes the error handling itself to crash. Consider guarding the access with optional chaining: `run.workflowHistory?.at(-1)`.

Evidence trail:
packages/workflow-executor/src/adapters/forest-server-workflow-port.ts line 134: `run.workflowHistory.at(-1)` without optional chaining
packages/workflow-executor/src/adapters/server-types.ts line 120: `workflowHistory: ServerStepHistory[]` (non-nullable type, but data from network)
packages/workflow-executor/src/adapters/forest-server-workflow-port.ts lines 63-76: catch block calling `toMalformedInfo` at line 69 when error is `WorkflowExecutorError`
packages/workflow-executor/src/adapters/forest-server-workflow-port.ts lines 107-128: `toDispatch` throws `InvalidStepDefinitionError` at lines 109 and 118 BEFORE `workflowHistory` is accessed
packages/workflow-executor/src/adapters/forest-server-workflow-port.ts lines 55-57: data comes from server HTTP response with no runtime type validation