feat(ai): teach rule agent cross-endpoint workflow patterns

[tangcent]

Summary

Adds a Workflow-Pattern Catalog to the rule-authoring agent's knowledge base, so it can detect and build cross-endpoint workflow patterns (not just single-endpoint custom-pattern shapes): auth-token chaining, static auth, per-request injection, HMAC signing, and 401-refresh.

The agent now recognises producing endpoints (e.g. /login returning a token) and consuming endpoints, and proposes a complete rule bundle — method.additional.header + postman.test/postman.prerequest + http.call.after — wired by a shared env-var name, in a single propose_rule_content call.

Changes

Knowledge / prompt (canonical: rule-guide.md, mirrored to preamble + external skill)

• New Workflow Patterns section: detection signals (PSI shape, endpoint shape, response-field naming) + full rule recipes + the three correctness rules (postman.test fires after response / postman.prerequest before request; shared-env-var name; never strip legitimate auth fields).
• agent-preamble.md: condensed workflow-detection section + perceive→reason→act guidance.
• Magic instruction gains one sentence naming the workflow signals.

Runtime enablers (narrowly scoped, 401-refresh only)

• ScriptHttpClient.executeSync — synchronous HTTP callable from Groovy scripts (runBlocking, dedicated dispatcher).
• Mutable HttpRequestWrapper — the retried request can carry a refreshed Authorization header.
• Thread-local recursion guard caps nested script-driven calls.

Env-var name reuse — resolved from existing rules, not the Environments panel. The agent greps ${...} out of existing method.additional.header values via get_existing_rules_for_key, defaulting to Authorization. The panel holds runtime values (out of scope for a rule-authoring agent), and even its keys can leak vendor/infrastructure hints (e.g. STRIPE_SECRET_KEY) into the transcript sent to the LLM provider.

No new rule keys, no new pm.* surface, no change to EnvironmentService / RequestExecutor / EndpointBuilder.

Test plan

• RuleGuideWorkflowCatalogTest — catalog anchor strings present; postman.test (not prerequest) for token extraction; scope note present.
• ScriptHttpClientTest — executeSync returns response, no deadlock on background thread.
• Jsr223CryptoInteropTest — HmacSHA256 interop from a groovy: rule (Resolves Open Question support export api from spring to postman #1).
• Jsr223ScriptParserBindingTest / PmScriptExecutorBindingTest — httpClient binding scoped to rule scripts only.
• HttpClientScriptInterceptorTest — retry sends the mutated request; recursion-depth guard caps nested calls.
• AmbientPerceptionTest / SystemPromptBuilderTest — ambient contract pinned (locale hint; no env-var surface).
• EasyApiAssistantSkillTest — external skill mirrors canonical knowledge base.

All targeted tests green (./gradlew test --tests "*RuleGuideWorkflowCatalogTest*" --tests "*ScriptHttpClientTest*" --tests "*AmbientPerceptionTest*" --tests "*SystemPromptBuilderTest*" ...).

Design notes

• Knowledge base is canonical; preamble / Magic / external skill mirror it (drift caught by RuleGuideWorkflowCatalogTest).
• The 401-refresh recipe is first-class (working script, not a scaffold), backed by the end-to-end interceptor test.

Spec: .spec/ai-workflow-patterns/ (local; not in this PR).

[github-actions]

📦 Plugin has been packaged for this PR. You can download easy-api-3.1.6.252.0.zip from the GitHub Actions workflow run by clicking on the "Artifacts" dropdown.

[codecov]

Codecov Report

❌ Patch coverage is 95.00000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 64.191%. Comparing base (ccf94d6) to head (5407a3a).

Files with missing lines	Patch %	Lines
...ngcent/easyapi/http/HttpClientScriptInterceptor.kt	97.222%	0 Missing and 1 partial ⚠️
...tangcent/easyapi/rule/parser/Jsr223ScriptParser.kt	50.000%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@              Coverage Diff              @@
##            master      #732       +/-   ##
=============================================
+ Coverage   64.146%   64.191%   +0.045%     
=============================================
  Files          375       376        +1     
  Lines        21398     21422       +24     
  Branches      5262      5266        +4     
=============================================
+ Hits         13726     13751       +25     
+ Misses        5754      5750        -4     
- Partials      1918      1921        +3     

Flag	Coverage Δ
unittests	64.191% <95.000%> (+0.045%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...tlin/com/itangcent/easyapi/ai/agent/AgentMemory.kt	100.000% <ø> (ø)
...om/itangcent/easyapi/ai/agent/AmbientPerception.kt	77.778% <ø> (ø)
...lin/com/itangcent/easyapi/http/ScriptHttpClient.kt	100.000% <100.000%> (ø)
...ngcent/easyapi/http/HttpClientScriptInterceptor.kt	98.246% <97.222%> (+12.531%)	⬆️
...tangcent/easyapi/rule/parser/Jsr223ScriptParser.kt	51.579% <50.000%> (-1.053%)	⬇️

... and 1 file with indirect coverage changes

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ccf94d6...5407a3a. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.