@agimon-ai/po-workflow 0.0.0-alpha.36 → 0.0.0-alpha.38

package/dist/{RecoverWorkflowService-BLehH1qi.cjs → RecoverWorkflowService-CbyTPDY-.cjs}

@@ -378,6 +378,7 @@ const StepFieldsSchema = zod.z.object({
 	artifacts: StepArtifactsSchema.optional(),
 	"timeout-minutes": zod.z.number().optional(),
 	env: CoercedEnvRecord.optional(),
+	secrets: zod.z.array(zod.z.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "Secret names are environment variable names.")).min(1).optional().describe("Env names a run step's command receives from its Po profile; values never reach logs or run records."),
 	with: zod.z.record(zod.z.string(), zod.z.string()).optional(),
 	"working-directory": zod.z.string().optional(),
 	if: zod.z.string().optional(),
@@ -418,6 +419,11 @@ function refineStep(step, context) {
 		message: `${key} is only supported with a templated interactiveRun.`,
 		path: [key]
 	});
+	if (step.secrets !== void 0 && (step.run === void 0 || step.interactiveRun || step.customRun)) context.addIssue({
+		code: "custom",
+		message: "secrets are only supported on run steps.",
+		path: ["secrets"]
+	});
 	if (step["restart-from"] !== void 0 && (step.run === void 0 || step.interactiveRun || step.customRun)) context.addIssue({
 		code: "custom",
 		message: "restart-from is only supported on run steps.",
@@ -773,6 +779,7 @@ const WorkflowRunRecordSchema = zod.z.object({
 	runner: zod.z.string().optional(),
 	command: zod.z.string().optional().describe("Command the launch selected for templated interactiveRun steps."),
 	choice: zod.z.string().optional().describe("Choice the launch selected for steps that do not pin one."),
+	profile: zod.z.string().optional().describe("Po profile name the launch selected as the default runConfig.profile; never its secrets."),
 	runId: zod.z.string().uuid().optional(),
 	runKey: zod.z.string(),
 	secretFile: zod.z.string().optional(),
@@ -4759,6 +4766,7 @@ var WorkflowRegistryService = class {
 			runner: input.runner,
 			...input.command === void 0 ? {} : { command: input.command },
 			...input.choice === void 0 ? {} : { choice: input.choice },
+			...input.profile === void 0 ? {} : { profile: input.profile },
 			runDirectory: input.runDirectory,
 			runId,
 			secretFile: input.secretFile,
@@ -6620,6 +6628,10 @@ const INTERACTIVE_RUN_KEY = "interactiveRun";
 const CUSTOM_RUN_KEY = "customRun";
 const CUSTOM_RUN_UNSUPPORTED_MESSAGE = "customRun needs a host step executor and no run or interactiveRun fallback exists for step";
 const IN_PROCESS_ONLY_UNSUPPORTED_MESSAGE = "has no run template, and this host cannot run it in-process";
+const SECRETS_UNAVAILABLE_MESSAGE = "profile secrets are unavailable for step";
+const SECRETS_LOG_PREFIX = "secrets: ";
+const RUN_CONFIG_PROFILE_KEY = "profile";
+const REDACTED = "[redacted]";
 const WORKFLOW_RUN_CONFIG_ENV_KEY = "WORKFLOW_RUN_CONFIG";
 const DEFAULT_CHOICE = "default";
 const OUTPUT_TAIL_LINES = 50;
@@ -6736,6 +6748,21 @@ const RESULT_STATUS_PAUSE_REQUESTED = "pause_requested";
 /** The reason a step failure carries when nothing more specific was recorded. */
 const STEP_FAILED_REASON = "The step failed.";
 /**
+* Mask each secret value in step output, in its raw, JSON-escaped and
+* URL-encoded forms, and line by line for a value that spans lines.
+*/
+function secretRedactor(values) {
+	const forms = /* @__PURE__ */ new Set();
+	for (const value of values) for (const form of [
+		value,
+		JSON.stringify(value).slice(1, -1),
+		encodeURIComponent(value),
+		...value.split("\n")
+	]) if (form) forms.add(form);
+	const longestFirst = [...forms].sort((left, right) => right.length - left.length);
+	return (text) => longestFirst.reduce((current, form) => current.split(form).join(REDACTED), text);
+}
+/**
 * Executes workflow steps in child processes and tracks the active process so
 * the workflow runner can interrupt it safely.
 *
@@ -6753,6 +6780,7 @@ var StepRunnerService = class StepRunnerService {
 	runDirectoryService;
 	ownsTerminal;
 	stepExecutor;
+	resolveSecrets;
 	activeStep = null;
 	activeExternal = null;
 	lastInteractiveReap = null;
@@ -6772,7 +6800,7 @@ var StepRunnerService = class StepRunnerService {
 	* must not hand a step's stdin to it, and must not `stty` or reset it
 	* afterwards, however cooperative the intent.
 	*/
-	constructor(runtime, parser, logger, quotaService = new CodexQuotaService(runtime), watchStatusFile = runtime.fs.watch.bind(runtime.fs), runDirectoryService = new RunDirectoryService(runtime), ownsTerminal = true, stepExecutor) {
+	constructor(runtime, parser, logger, quotaService = new CodexQuotaService(runtime), watchStatusFile = runtime.fs.watch.bind(runtime.fs), runDirectoryService = new RunDirectoryService(runtime), ownsTerminal = true, stepExecutor, resolveSecrets) {
 		this.runtime = runtime;
 		this.parser = parser;
 		this.logger = logger;
@@ -6781,6 +6809,7 @@ var StepRunnerService = class StepRunnerService {
 		this.runDirectoryService = runDirectoryService;
 		this.ownsTerminal = ownsTerminal;
 		this.stepExecutor = stepExecutor;
+		this.resolveSecrets = resolveSecrets;
 	}
 	/**
 	* Use a workflow's command templates and choices, and what the launch
@@ -6797,7 +6826,7 @@ var StepRunnerService = class StepRunnerService {
 	* Release it once its step has finished.
 	*/
 	fork(label) {
-		const child = new StepRunnerService(this.runtime, this.parser, labelledLogger(this.logger, label), this.quotaService, this.watchStatusFile, this.runDirectoryService, this.ownsTerminal, this.stepExecutor);
+		const child = new StepRunnerService(this.runtime, this.parser, labelledLogger(this.logger, label), this.quotaService, this.watchStatusFile, this.runDirectoryService, this.ownsTerminal, this.stepExecutor, this.resolveSecrets);
 		child.commandSelection = this.commandSelection;
 		child.interruptedSignal = this.interruptedSignal;
 		child.terminalLock = this.terminalLock;
@@ -6964,7 +6993,12 @@ var StepRunnerService = class StepRunnerService {
 		stepEnv[PROJECT_PATH_ENV_KEY] = workDir;
 		stepEnv[WORKFLOW_STEP_NAME_ENV_KEY] = stepName;
 		stepEnv[WORKFLOW_STEP_DISPLAY_ENV_KEY] = this.formatStepDisplay(stepEnv[WORKFLOW_JOB_NAME_ENV_KEY], stepName);
-		const runConfig = resolvedStepCommand?.runConfig ?? step.runConfig;
+		const stepRunConfig = resolvedStepCommand?.runConfig ?? step.runConfig;
+		const launchProfile = this.commandSelection.profile;
+		const runConfig = launchProfile === void 0 || stepRunConfig?.[RUN_CONFIG_PROFILE_KEY] !== void 0 ? stepRunConfig : {
+			...stepRunConfig,
+			[RUN_CONFIG_PROFILE_KEY]: launchProfile
+		};
 		stepEnv[WORKFLOW_RUN_CONFIG_ENV_KEY] = JSON.stringify(runConfig ?? {});
 		if (step.if !== void 0 && !options.dryRun) {
 			const condition = await this.evaluateStepCondition(step.if, stepContext, workDir, stepEnv, stepName, timeoutMs);
@@ -7024,6 +7058,7 @@ var StepRunnerService = class StepRunnerService {
 		if (options.dryRun) {
 			this.logger.info(`    ${CYAN$2}${STATUS_DRY}${RESET$3}  ${stepName}`);
 			this.logger.info(`${COMMAND_LOG_INDENT}${DIM$3}${COMMAND_LOG_PROMPT}${command.split(COMMAND_LINE_BREAK).join(COMMAND_LOG_CONTINUATION)}${RESET$3}`);
+			if (step.secrets !== void 0 && step.secrets.length > 0) this.logger.info(`${COMMAND_LOG_INDENT}${DIM$3}${SECRETS_LOG_PREFIX}${step.secrets.join(", ")}${RESET$3}`);
 			await this.logStepLifecycle("info", "workflow.step.finished", stepEnv, {
 				"workflow.step.duration_ms": Date.now() - stepStartedAt,
 				"workflow.step.outcome": "dry-run"
@@ -7055,6 +7090,19 @@ var StepRunnerService = class StepRunnerService {
 			this.logger.error(`    ${RED$2}${STATUS_FAIL}${RESET$3}  ${stepName}\n`);
 			return false;
 		}
+		let secretEnv;
+		if (step.secrets !== void 0 && step.secrets.length > 0) {
+			secretEnv = await this.resolveStepSecrets(step.secrets, runConfig, interactive || custom !== void 0 || inProcessOnly === true);
+			if (secretEnv === void 0) {
+				fail(`${SECRETS_UNAVAILABLE_MESSAGE} "${stepName}"`);
+				if (shouldContinue) {
+					this.logger.warn(`    ${YELLOW$2}${STATUS_FAIL}${RESET$3}  ${stepName} ${CONTINUE_ON_ERROR_SUFFIX}\n`);
+					return true;
+				}
+				this.logger.error(`    ${RED$2}${STATUS_FAIL}${RESET$3}  ${stepName}\n`);
+				return false;
+			}
+		}
 		let quotaFailureRetried = false;
 		for (let attempt = 0; attempt <= maxTimeoutRetries; attempt++) {
 			await this.waitForCodexQuotaAvailability(stepName, command, isCodexCommand);
@@ -7082,6 +7130,7 @@ var StepRunnerService = class StepRunnerService {
 				interactive,
 				onExecutionStarted: options.onExecutionStarted,
 				runConfig,
+				secretEnv,
 				stepEnv,
 				stepName,
 				jobEnvironment: this.definedEnv({
@@ -7342,10 +7391,30 @@ var StepRunnerService = class StepRunnerService {
 		};
 	}
 	/**
+	* Resolve a run step's secrets for its child alone, or undefined when they
+	* cannot be: this host has no resolver, the step is not a plain run, no
+	* profile applies, or the resolver fails. The failure stays generic so no
+	* value or alias detail reaches the log.
+	*/
+	async resolveStepSecrets(names, runConfig, hostedStep) {
+		const profile = runConfig?.[RUN_CONFIG_PROFILE_KEY];
+		if (this.resolveSecrets === void 0 || hostedStep || typeof profile !== "string" || profile === "") return;
+		try {
+			return await this.resolveSecrets({
+				cwd: this.runtime.cwd,
+				profile,
+				names
+			});
+		} catch {
+			return;
+		}
+	}
+	/**
 	* Spawn a child shell for the step command and normalize its termination
 	* into a typed result.
 	*/
-	async executeCommand(command, workDir, stepEnv, stepName, interactive, timeoutMs) {
+	async executeCommand(command, workDir, stepEnv, stepName, interactive, timeoutMs, secretEnv) {
+		const redact = secretEnv === void 0 ? void 0 : secretRedactor(Object.values(secretEnv));
 		if (interactive) this.logger.info(`    ${DIM$3}${INTERACTIVE_OUTPUT_NOTICE}${RESET$3}`);
 		return await new Promise((resolveResult) => {
 			const terminalState = interactive ? this.captureTerminalState() : null;
@@ -7372,6 +7441,7 @@ var StepRunnerService = class StepRunnerService {
 				detached: this.runtime.workflowHost.platform !== PLATFORM_WINDOWS,
 				env: {
 					...stepEnv,
+					...secretEnv,
 					[FORCE_COLOR_KEY]: FORCE_COLOR_VALUE
 				},
 				shell: DEFAULT_SHELL
@@ -7439,18 +7509,30 @@ var StepRunnerService = class StepRunnerService {
 				outputTail.push(line);
 				if (outputTail.length > OUTPUT_TAIL_LINES) outputTail.shift();
 			};
-			child.stdout?.on("data", (data) => {
-				for (const line of data.toString().split("\n")) if (line) {
-					keep(line);
-					this.logger.info(line);
-				}
-			});
-			child.stderr?.on("data", (data) => {
-				for (const line of data.toString().split("\n")) if (line) {
-					keep(line);
-					this.logger.error(line);
-				}
-			});
+			const lineReader = (emit) => {
+				let pending = "";
+				const show = (line) => {
+					if (!line) return;
+					const shown = redact === void 0 ? line : redact(line);
+					keep(shown);
+					emit(shown);
+				};
+				return {
+					push: (data) => {
+						const lines = (pending + data.toString()).split("\n");
+						pending = redact === void 0 ? "" : lines.pop() ?? "";
+						for (const line of lines) show(line);
+					},
+					flush: () => {
+						show(pending);
+						pending = "";
+					}
+				};
+			};
+			const stdout = lineReader((line) => this.logger.info(line));
+			const stderr = lineReader((line) => this.logger.error(line));
+			child.stdout?.on("data", stdout.push);
+			child.stderr?.on("data", stderr.push);
 			child.on("error", (error) => {
 				settle({
 					status: "spawn_error",
@@ -7465,6 +7547,8 @@ var StepRunnerService = class StepRunnerService {
 			child.on("exit", async (code, signal) => {
 				if (!interactive) await this.cleanupProcessGroup();
 				await outputDrained(child);
+				stdout.flush();
+				stderr.flush();
 				if (timedOut && timeoutMs !== null) {
 					settle({
 						status: "timed_out",
@@ -7506,6 +7590,7 @@ var StepRunnerService = class StepRunnerService {
 	*/
 	startStepExecution(request) {
 		const { command, custom, inProcessOnly, interactive, stepEnv, stepName, template, timeoutMs, workDir } = request;
+		if (request.secretEnv !== void 0) return this.executeCommand(command, workDir, stepEnv, stepName, false, timeoutMs, request.secretEnv);
 		const executor = this.stepExecutor;
 		const base = {
 			traceparent: request.traceparent,
@@ -9551,7 +9636,7 @@ var RunWorkflowService = class {
 		this.launcherMetadata = dependencies.launcherMetadata;
 		this.parser = dependencies.parser ?? new WorkflowParserService(this.runtime);
 		this.serviceManager = dependencies.serviceManager ?? new BackgroundServiceManager(this.runtime, this.logger);
-		this.stepRunner = dependencies.stepRunner ?? new StepRunnerService(this.runtime, this.parser, this.logger, void 0, void 0, void 0, dependencies.ownsTerminal, dependencies.stepExecutor);
+		this.stepRunner = dependencies.stepRunner ?? new StepRunnerService(this.runtime, this.parser, this.logger, void 0, void 0, void 0, dependencies.ownsTerminal, dependencies.stepExecutor, dependencies.resolveSecrets);
 		this.registry = dependencies.registry ?? new WorkflowRegistryService(this.runtime);
 		this.runDirectoryService = dependencies.runDirectoryService ?? new RunDirectoryService(this.runtime, this.registry.writeCoordinator);
 		this.jobRunner = dependencies.jobRunner ?? new JobRunnerService(this.runtime, this.parser, this.stepRunner, this.logger, this.runDirectoryService);
@@ -9745,7 +9830,8 @@ var RunWorkflowService = class {
 			commands: workflow.commands,
 			choices: workflow.choices,
 			command: input.command,
-			choice: input.choice
+			choice: input.choice,
+			profile: input.profile
 		});
 	}
 	resolveRunner(input, workflow) {
@@ -9897,6 +9983,7 @@ var RunWorkflowService = class {
 				runner,
 				command: input.command,
 				choice: input.choice,
+				profile: input.profile,
 				runDirectory: workflow["run-directory"],
 				secretFile: input.secretFile,
 				skipLaunch: input.skipLaunch,
@@ -10888,6 +10975,7 @@ var RunWorkflowService = class {
 		if (runner) parts.push("--runner", require_workflowCommandTemplate.escapeShellArg(runner));
 		if (input.command) parts.push("--command", require_workflowCommandTemplate.escapeShellArg(input.command));
 		if (input.choice) parts.push("--choice", require_workflowCommandTemplate.escapeShellArg(input.choice));
+		if (input.profile) parts.push("--profile", require_workflowCommandTemplate.escapeShellArg(input.profile));
 		if (input.dryRun) parts.push("--dry-run");
 		if (input.continueOnError) parts.push("--continue-on-error");
 		if (input.keepWorktree) parts.push("--keep-worktree");
@@ -11211,6 +11299,7 @@ var RecoverWorkflowService = class {
 			runner,
 			command: record.command,
 			choice: record.choice,
+			profile: record.profile,
 			workflowPath: record.workflowPath,
 			job: recoveredJob,
 			inputs: record.inputs,
@@ -11456,4 +11545,4 @@ Object.defineProperty(exports, "workflowShellOutput", {
 	}
 });
 
-//# sourceMappingURL=RecoverWorkflowService-BLehH1qi.cjs.map
+//# sourceMappingURL=RecoverWorkflowService-CbyTPDY-.cjs.map