test: cover hosted-web engine forms and schema rejections in compiler tests

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Author: Copilot

pkg/workflow/hosted_web_compile_test.go

@@ -104,6 +104,52 @@ Test workflow.`,
 				`\"claude\":{\"enabled\":false}`,
 			},
 		},
+		{
+			name: "engine object form resolves to the claude runtime",
+			frontmatter: `---
+on: workflow_dispatch
+engine:
+  id: claude
+  model: claude-3-5-sonnet-20241022
+network:
+  allowed:
+    - defaults
+  hosted-web:
+    allowed:
+      - docs.github.com
+---
+
+# Test
+Test workflow.`,
+			wantContains: []string{
+				`\"hostedWeb\"`,
+				`\"claude\":{\"enabled\":true,\"allowedDomains\":[\"docs.github.com\"]}`,
+			},
+		},
+		{
+			name: "inline runtime definition resolves to the codex runtime",
+			frontmatter: `---
+on: workflow_dispatch
+engine:
+  runtime:
+    id: codex
+  provider:
+    model: gpt-5
+network:
+  allowed:
+    - defaults
+  hosted-web:
+    blocked:
+      - example.com
+---
+
+# Test
+Test workflow.`,
+			wantContains: []string{
+				`\"hostedWeb\"`,
+				`\"codex\":{\"enabled\":true,\"blockedDomains\":[\"example.com\"]}`,
+			},
+		},
 		{
 			name: "no network configuration omits hostedWeb entirely",
 			frontmatter: `---
@@ -224,3 +270,86 @@ Test workflow.`
 		t.Errorf("Expected error to reference network.hosted-web, got: %v", err)
 	}
 }
+
+// TestCompileWorkflow_HostedWebRejectsInvalidFrontmatter verifies that the
+// frontmatter schema rejects unsupported hosted-web syntax at compile time,
+// covering the removed `enabled` field and the AWF domain-list constraints.
+func TestCompileWorkflow_HostedWebRejectsInvalidFrontmatter(t *testing.T) {
+	longDomain := strings.Repeat(strings.Repeat("a", 60)+".", 4) + "example.com"
+
+	tests := []struct {
+		name        string
+		hostedWeb   string
+		wantMessage string
+	}{
+		{
+			name: "enabled field is not part of the frontmatter contract",
+			hostedWeb: `  hosted-web:
+    enabled: true
+    allowed:
+      - docs.github.com`,
+			wantMessage: "hosted-web",
+		},
+		{
+			name: "duplicate allowed domains are rejected",
+			hostedWeb: `  hosted-web:
+    allowed:
+      - docs.github.com
+      - docs.github.com`,
+			wantMessage: "are equal",
+		},
+		{
+			name: "allowed domains longer than 253 characters are rejected",
+			hostedWeb: `  hosted-web:
+    allowed:
+      - ` + longDomain,
+			wantMessage: "maxLength",
+		},
+		{
+			name: "duplicate blocked domains are rejected",
+			hostedWeb: `  hosted-web:
+    blocked:
+      - example.com
+      - example.com`,
+			wantMessage: "are equal",
+		},
+		{
+			name: "blocked domains longer than 253 characters are rejected",
+			hostedWeb: `  hosted-web:
+    blocked:
+      - ` + longDomain,
+			wantMessage: "maxLength",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			frontmatter := `---
+on: workflow_dispatch
+engine: claude
+network:
+  allowed:
+    - defaults
+` + tt.hostedWeb + `
+---
+
+# Test
+Test workflow.`
+
+			tmpDir := testutil.TempDir(t, "hosted-web-invalid-frontmatter-test")
+			testFile := filepath.Join(tmpDir, "test-workflow.md")
+			if err := os.WriteFile(testFile, []byte(frontmatter), 0644); err != nil {
+				t.Fatalf("Failed to write workflow file: %v", err)
+			}
+
+			compiler := NewCompiler()
+			err := compiler.CompileWorkflow(testFile)
+			if err == nil {
+				t.Fatal("Expected compilation to fail for invalid hosted-web frontmatter")
+			}
+			if !strings.Contains(err.Error(), tt.wantMessage) {
+				t.Errorf("Expected error to contain %q, got: %v", tt.wantMessage, err)
+			}
+		})
+	}
+}