agent/workbench

OPENROUTER_API_KEY=... just agent-workbench
# then open http://127.0.0.1:3030

TAVILY_API_KEY

Key for the web.search(...) and web.fetch(...) tools, matching the CLI web tools. Optional; the rest of the workbench runs without it.

OPENROUTER_MODEL

Default model id for new chats. Defaults to anthropic/claude-sonnet-4.6.

OPENROUTER_MODEL_VARIANT

Default reasoning variant. Defaults to high; choose provider default in the UI to send no variant for models without configurable thinking.

AGENT_WORKBENCH_ADDR

Browser bind address. Defaults to 127.0.0.1:3030.

AGENT_WORKBENCH_DATA_DIR

Persistence, plus the JSONL turn and Lashlang-execution traces. Defaults to .agent-workbench.

The entrypoint also manages the workbench's Restate endpoint bind (AGENT_WORKBENCH_RESTATE_ADDR, default 127.0.0.1:9081), the Restate container ports (ingress 8080, admin 19070, node 19071), and the Tokio worker stack (AGENT_WORKBENCH_TOKIO_STACK_BYTES, default 8 MiB / 8388608 bytes; override only when diagnosing stack regressions). See examples/agent-workbench/README.md for the full list.

Restate owns in-flight workflow replay by turn_id, Lash owns the session execution lease and final turn commit, and the workbench product log persists user-visible events with stable ids and monotonic per-session positions.

process on_button(event: ui.button.Pressed) {
  wake { kind: "button_pressed", button: event.button, message: event.message }
  finish true
}

handle = await triggers.register({
  source: ui.button.pressed({}),
  target: on_button,
  inputs: { event: trigger.event },
  name: "button watcher"
})?
registrations = await triggers.list({ name: "button watcher" })?
finish { handle: handle, registrations: registrations }

process daily_digest(tick: cron.Tick) {
  wake { kind: "daily_digest_due", tick: tick }
  finish true
}

source = cron.Schedule({ expr: "0 8 * * *", tz: "UTC" })
handle = await triggers.register({
  source: source,
  target: daily_digest,
  inputs: { tick: trigger.event },
  name: "daily_digest"
})?
finish { handle: handle, registrations: await triggers.list({ target: daily_digest })? }

After a Restate-backed turn registers an enabled cron.Schedule, the workbench syncs that source key to WorkbenchCronJob/{session_id}:{source_key}. The virtual object stores the source request, the next execution timestamp, and the Restate invocation id in Restate K/V state. Its run handler first schedules the next run with a delayed Restate send (so a tick that fails cannot kill the schedule), then emits a validated cron.Tick trigger occurrence whose idempotency key includes the journaled fire time: unique per tick, stable across retries of the same tick. A cron remains valid while its owning session has durable store metadata, including when another workbench session is current. A job whose session has a permanent deletion tombstone cancels with reason: "session_retired"; a job with neither a tombstone nor session store metadata cancels as an orphan with reason: "session_absent". Resetting the workbench cancels the old session's cron jobs derived from its durable trigger registrations (plus anything armed in-process), and an equal-request re-sync revives a chain whose stored next execution is already in the past. The disposition read and cancel trace are Restate-journaled. Tick and zombie-guard traces record session_state: "live", "retired", or "unknown". The trace JSONL includes agent_workbench.cron.restate.sync_upserted, agent_workbench.cron.restate.run, and agent_workbench.cron.restate.zombie_cancelled events.

Approval is deliberately not a Lash manifest capability. It is host policy: the host chooses gated tools, authenticates operators, stores pending decisions, and defines their outcomes. Lash core will never grow an approval flag or approval/revert surface; its only responsibility is the general completion-key park/resume primitive.

fn field(name: &str, ty: lashlang::TypeExpr) -> lashlang::TypeField {
    lashlang::TypeField {
        name: name.into(),
        ty,
        optional: false,
    }
}

fn schedule_config_type() -> lashlang::TypeExpr {
    lashlang::TypeExpr::Object(vec![
        field("expr", lashlang::TypeExpr::Str),
        lashlang::TypeField {
            name: "tz".into(),
            ty: lashlang::TypeExpr::Str,
            optional: true,
        },
    ])
}

fn cron_tick_event_type() -> lashlang::NamedDataType {
    lashlang::NamedDataType::object(
        "cron.Tick",
        vec![field("fired_at", lashlang::TypeExpr::Str)],
    )
    .expect("valid cron tick type")
}

fn button_trigger_event_type() -> lashlang::NamedDataType {
    lashlang::NamedDataType::object(
        "ui.button.Pressed",
        vec![
            field(
                "button",
                lashlang::TypeExpr::Union(vec![
                    lashlang::TypeExpr::Enum(vec!["Red".into()]),
                    lashlang::TypeExpr::Enum(vec!["Blue".into()]),
                ]),
            ),
            field("message", lashlang::TypeExpr::Str),
            field("pressed_at", lashlang::TypeExpr::Str),
        ],
    )
    .expect("valid button trigger event type")
}

fn button_trigger_payload_schema() -> lash::triggers::LashSchema {
    lash::triggers::LashSchema::new(serde_json::json!({
        "type": "object",
        "properties": {
            "button": { "type": "string", "enum": ["Red", "Blue"] },
            "message": { "type": "string" },
            "pressed_at": { "type": "string" }
        },
        "required": ["button", "message", "pressed_at"],
        "additionalProperties": false
    }))
}

fn mail_received_event_type() -> lashlang::NamedDataType {
    lashlang::NamedDataType::object(
        "mail.Received",
        vec![
            field("account", lashlang::TypeExpr::Str),
            field("title", lashlang::TypeExpr::Str),
            field("text", lashlang::TypeExpr::Str),
        ],
    )
    .expect("valid mail received event type")
}

fn workbench_lashlang_resources() -> lashlang::LashlangHostCatalog {
    let mut resources = lashlang::LashlangHostCatalog::new();
    resources
        .add_trigger_source_constructor(
            ["cron", "Schedule"],
            schedule_config_type(),
            cron_tick_event_type(),
        )
        .expect("valid cron trigger source");
    resources
        .add_trigger_source_constructor(
            ["mail", "received"],
            lashlang::TypeExpr::Object(vec![]),
            mail_received_event_type(),
        )
        .expect("valid mail trigger source");
    resources
}

fn declare_button_event(reg: &mut PluginRegistrar) -> Result<(), PluginError> {
    reg.triggers().declare(TriggerEvent::new(
        "Button",
        "ui.button",
        "pressed",
        button_trigger_payload_schema(),
    ))?;
    Ok(())
}

just agent-workbench-restate-e2e

The recipe schedules cron.Schedule({ expr: "*/2 * * * * *", tz: "UTC" }), waits for the Restate virtual object to fire a cron.Tick, asserts the queued turn ran, verifies the submitted invocation completed successfully, asserts no Workbench* or LashProcessWorkflow invocation remains active, and removes the container on exit.