@boardwalk-labs/runner 0.1.5 → 0.1.6

package/dist/runtime/index.js

@@ -299,7 +299,12 @@ export function assembleWorkerDeps(runtime) {
             // throws) so no language-server process leaks past the run.
             lsp: lspService,
             // The orchestrator emits the program's declared output onto the wire (`output` kind).
-            activity: { output: (value) => void runEvents.emit({ kind: "output", value }) },
+            // Redact the declared-output EVENT (observability): a secret the program put in output()
+            // must not surface in the run's event stream. The FUNCTIONAL output program_runner returns
+            // for `workflows.call` is a separate path and stays raw, so cross-workflow data flow is intact.
+            activity: {
+                output: (value) => void runEvents.emit({ kind: "output", value: redactor.redactValue(value) }),
+            },
             // Filled by the runner once the artifact extracts; the leaf's `skillsDir` thunk reads it.
             setProgramDir: (dir) => {
                 programDir = dir;

package/dist/runtime/program_log_capture.d.ts

@@ -4,7 +4,13 @@ export type LogStream = "stdout" | "stderr";
  * Patch the global console so each call is forwarded to the original AND handed (formatted) to
  * `sink`. Returns a restore function — ALWAYS call it (the worker runs `restore()` in a finally).
  */
-export declare function captureConsole(sink: (stream: LogStream, text: string) => void): () => void;
+export declare function captureConsole(sink: (stream: LogStream, text: string) => void, 
+/** Scrub known secret values from each formatted line before it reaches EITHER sink. A program
+ *  that `console.log`s a resolved secret must not leak it — to the run's `program_output` events
+ *  OR to container stdout (CloudWatch). We format+redact once and print the SAME redacted string
+ *  to the original console (equivalent output; `util.format` is what console does internally).
+ *  Defaults to identity (tests/local). */
+redact?: (text: string) => string): () => void;
 export interface ProgramLogSinkOptions {
     /** The run's shared event emitter — program logs ride the one ordered stream (`log` channel). */
     sink: TurnEventSink;

package/dist/runtime/program_log_capture.js

@@ -24,7 +24,13 @@ const STREAM_BY_METHOD = {
  * Patch the global console so each call is forwarded to the original AND handed (formatted) to
  * `sink`. Returns a restore function — ALWAYS call it (the worker runs `restore()` in a finally).
  */
-export function captureConsole(sink) {
+export function captureConsole(sink, 
+/** Scrub known secret values from each formatted line before it reaches EITHER sink. A program
+ *  that `console.log`s a resolved secret must not leak it — to the run's `program_output` events
+ *  OR to container stdout (CloudWatch). We format+redact once and print the SAME redacted string
+ *  to the original console (equivalent output; `util.format` is what console does internally).
+ *  Defaults to identity (tests/local). */
+redact = (t) => t) {
     const console_ = globalThis.console;
     const originals = {};
     for (const [method, stream] of Object.entries(STREAM_BY_METHOD)) {
@@ -33,9 +39,10 @@ export function captureConsole(sink) {
             continue;
         originals[method] = original;
         console_[method] = (...args) => {
-            original.apply(console_, args); // still print to the container stdout (CloudWatch)
+            const text = redact(format(...args));
+            original.call(console_, text); // print the REDACTED line to container stdout (CloudWatch)
             try {
-                sink(stream, format(...args));
+                sink(stream, text);
             }
             catch {
                 // best-effort — a telemetry hiccup must never break the program's own logging

package/dist/runtime/program_worker.js

@@ -162,7 +162,9 @@ export async function runProgramWorker(runId, deps) {
     // by `flushFinal()` after the body (on every path except a lease_lost handoff).
     const runtimeFlush = deps.startRuntimeFlush?.({ run: claimed, startedAtMs: sessionStartMs });
     // Capture the program's console.* as `log` run-events for the duration of the body (best-effort).
-    const restoreConsole = deps.onProgramLog !== undefined ? captureConsole(deps.onProgramLog) : () => undefined;
+    const restoreConsole = deps.onProgramLog !== undefined
+        ? captureConsole(deps.onProgramLog, (text) => redactor.redactText(text))
+        : () => undefined;
     let result;
     try {
         result = await runWorkflowProgram({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boardwalk-labs/runner",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Boardwalk self-hosted runner: execute cloud-scheduled runs on your own machines. Currently: the canonical runner contract types.",
   "license": "Apache-2.0",
   "repository": {