feat: wire real AgentOS execution

packages/backend/convex/workExecutionAgent.ts

@@ -1,7 +1,11 @@
 "use node";
 
 import { env } from "@code/env/convex";
-import { decodeWorkAttemptExecutionResult } from "@code/primitives/execution-runtime";
+import {
+  WorkAttemptExecutionError,
+  decodeWorkAttemptExecutionFailure,
+  decodeWorkAttemptExecutionResult,
+} from "@code/primitives/execution-runtime";
 import { ConvexError, v } from "convex/values";
 import { Effect } from "effect";
 
@@ -56,23 +60,36 @@ export const executeAttempt = internalAction({
     );
     const payload = (await response.json()) as unknown;
     if (!response.ok) {
-      throw new ConvexError(
-        typeof payload === "object" && payload && "error" in payload
-          ? String(payload.error)
-          : `Agent backend returned ${response.status}`
+      // Decode the agent's classified failure envelope and re-throw as the
+      // typed runtime error so the workflow handler maps reason/retryable to
+      // a durable attempt classification. A malformed envelope falls back to
+      // an InvalidInput failure (non-retryable).
+      const failure = await Effect.runPromise(
+        decodeWorkAttemptExecutionFailure(payload)
       );
+      throw new WorkAttemptExecutionError(failure.error);
     }
     return await Effect.runPromise(decodeWorkAttemptExecutionResult(payload));
   },
 });
 
 export const cancelAttempt = internalAction({
-  args: { workspaceKey: v.string() },
+  args: {
+    attemptId: v.string(),
+    workspaceKey: v.string(),
+  },
   handler: async (_ctx, args) => {
+    // The workspace key remains the URL path segment (workspace identity),
+    // while the body carries the attemptId so the runtime can target the
+    // codex session `codex-${attemptId}` for cancellation.
     await fetch(
       `${backendUrl()}/internal/work-attempts/${encodeURIComponent(args.workspaceKey)}/cancel`,
       {
-        headers: { authorization: `Bearer ${env.FLUE_DB_TOKEN}` },
+        body: JSON.stringify({ attemptId: args.attemptId }),
+        headers: {
+          authorization: `Bearer ${env.FLUE_DB_TOKEN}`,
+          "content-type": "application/json",
+        },
         method: "POST",
       }
     );