Recursively visit payloads inside ScheduleNexusOperationCommandAttributes when using system nexus

[dplyukhin]

What

System Nexus messages shouldn't go through the codec because they're meant to be consumed by the Temporal service itself. But payloads inside the message should go through the codec.

How

Modify the payload visitor to treat ScheduleNexusOperationCommandAttributes commands in a special way if the endpoint is __temporal_system. Specifically, we deserialize them using proto type information in the metadata, and recursively visiting the payloads inside. This is similar to what we already do for anypb.Any messages with the defaultWellKnownAnyVisitor.

⚠️ This PR only works on the inputs for system nexus operations. The output of a system nexus operation doesn't have proto type metadata attached, so we'll have to do something else there.

Tests

• make proxy && (cd cmd/proxygenerator && go run ./ -verifyOnly) (generated code is current)
• go test -tags protolegacy ./...
• Add tests to proxy/system_nexus_test.go that exercise the happy and sad paths for visiting system nexus payloads

[CLAassistant]

All committers have signed the CLA.

[github-actions]

Opengrep — new findings

Severity	Location	Rule	Message
ERROR	.github/workflows/check-sdk-compat.yml:31	security.gha.missing-explicit-permissions-temporal	No explicit GITHUB_TOKEN permissions found at the workflow or job level. Add a permissions: block at the workflow root (applies to all jobs) or per job with least privilege (e.g., contents: read and only specific writes like pull-requests: write if needed).
ERROR	.github/workflows/ci.yml:10	security.gha.missing-explicit-permissions-temporal	No explicit GITHUB_TOKEN permissions found at the workflow or job level. Add a permissions: block at the workflow root (applies to all jobs) or per job with least privilege (e.g., contents: read and only specific writes like pull-requests: write if needed).
ERROR	.github/workflows/create-release.yml:30	security.gha.missing-explicit-permissions-temporal	No explicit GITHUB_TOKEN permissions found at the workflow or job level. Add a permissions: block at the workflow root (applies to all jobs) or per job with least privilege (e.g., contents: read and only specific writes like pull-requests: write if needed).
ERROR	.github/workflows/delete-release.yml:22	security.gha.missing-explicit-permissions-temporal	No explicit GITHUB_TOKEN permissions found at the workflow or job level. Add a permissions: block at the workflow root (applies to all jobs) or per job with least privilege (e.g., contents: read and only specific writes like pull-requests: write if needed).
ERROR	.github/workflows/publish-release.yml:22	security.gha.missing-explicit-permissions-temporal	No explicit GITHUB_TOKEN permissions found at the workflow or job level. Add a permissions: block at the workflow root (applies to all jobs) or per job with least privilege (e.g., contents: read and only specific writes like pull-requests: write if needed).
ERROR	.github/workflows/update-proto.yml:22	security.gha.missing-explicit-permissions-temporal	No explicit GITHUB_TOKEN permissions found at the workflow or job level. Add a permissions: block at the workflow root (applies to all jobs) or per job with least privilege (e.g., contents: read and only specific writes like pull-requests: write if needed).

---

Suppress findings

Add a noopengrep comment on the line before the finding:

# noopengrep: <rule-id>

[tconley1428]

Let's mention that it only handles system nexus inputs currently. We can't fix that quite yet but it would be good to remember.

[yuandrew]

I think this nested concurrent path should follow the top-level VisitPayloads wait-before-return shape. At the top level we do:

proxy/interceptor.go:110

err := visitPayloads(&visitCtx, &options, nil, c, msg)
c.wg.Wait()
if err != nil {
    return err
}

but here the function returns before waiting if recursive traversal returns an error.

Since localConcState can already have spawned visitor goroutines using the shared semaphore, an early traversal error or cancellation can let those goroutines continue after VisitPayloads returns.

There is a similar nested waitgroup pattern in defaultWellKnownAnyVisitor around proxy/interceptor.go:281, but it has the same early-return shape. I would use the top-level pattern here instead: store the traversal error, always wait on localConcState.wg, then return the traversal error or localConcState.firstErr.

[dplyukhin]

Nice catch! Fixed.