@boardwalk-labs/runner 0.1.5 → 0.1.7

package/dist/runtime/index.js

@@ -299,7 +299,12 @@ export function assembleWorkerDeps(runtime) {
             // throws) so no language-server process leaks past the run.
             lsp: lspService,
             // The orchestrator emits the program's declared output onto the wire (`output` kind).
-            activity: { output: (value) => void runEvents.emit({ kind: "output", value }) },
+            // Redact the declared-output EVENT (observability): a secret the program put in output()
+            // must not surface in the run's event stream. The FUNCTIONAL output program_runner returns
+            // for `workflows.call` is a separate path and stays raw, so cross-workflow data flow is intact.
+            activity: {
+                output: (value) => void runEvents.emit({ kind: "output", value: redactor.redactValue(value) }),
+            },
             // Filled by the runner once the artifact extracts; the leaf's `skillsDir` thunk reads it.
             setProgramDir: (dir) => {
                 programDir = dir;

package/dist/runtime/program_log_capture.d.ts

@@ -4,7 +4,13 @@ export type LogStream = "stdout" | "stderr";
  * Patch the global console so each call is forwarded to the original AND handed (formatted) to
  * `sink`. Returns a restore function — ALWAYS call it (the worker runs `restore()` in a finally).
  */
-export declare function captureConsole(sink: (stream: LogStream, text: string) => void): () => void;
+export declare function captureConsole(sink: (stream: LogStream, text: string) => void, 
+/** Scrub known secret values from each formatted line before it reaches EITHER sink. A program
+ *  that `console.log`s a resolved secret must not leak it — to the run's `program_output` events
+ *  OR to container stdout (CloudWatch). We format+redact once and print the SAME redacted string
+ *  to the original console (equivalent output; `util.format` is what console does internally).
+ *  Defaults to identity (tests/local). */
+redact?: (text: string) => string): () => void;
 export interface ProgramLogSinkOptions {
     /** The run's shared event emitter — program logs ride the one ordered stream (`log` channel). */
     sink: TurnEventSink;

package/dist/runtime/program_log_capture.js

@@ -24,7 +24,13 @@ const STREAM_BY_METHOD = {
  * Patch the global console so each call is forwarded to the original AND handed (formatted) to
  * `sink`. Returns a restore function — ALWAYS call it (the worker runs `restore()` in a finally).
  */
-export function captureConsole(sink) {
+export function captureConsole(sink, 
+/** Scrub known secret values from each formatted line before it reaches EITHER sink. A program
+ *  that `console.log`s a resolved secret must not leak it — to the run's `program_output` events
+ *  OR to container stdout (CloudWatch). We format+redact once and print the SAME redacted string
+ *  to the original console (equivalent output; `util.format` is what console does internally).
+ *  Defaults to identity (tests/local). */
+redact = (t) => t) {
     const console_ = globalThis.console;
     const originals = {};
     for (const [method, stream] of Object.entries(STREAM_BY_METHOD)) {
@@ -33,9 +39,10 @@ export function captureConsole(sink) {
             continue;
         originals[method] = original;
         console_[method] = (...args) => {
-            original.apply(console_, args); // still print to the container stdout (CloudWatch)
+            const text = redact(format(...args));
+            original.call(console_, text); // print the REDACTED line to container stdout (CloudWatch)
             try {
-                sink(stream, format(...args));
+                sink(stream, text);
             }
             catch {
                 // best-effort — a telemetry hiccup must never break the program's own logging

package/dist/runtime/program_runner.d.ts

@@ -10,6 +10,11 @@ import { type SuspendSignal } from "./suspension.js";
  * still exist.
  */
 export declare function ensureSdkLink(execDir: string): Promise<void>;
+/** Resolve the program's entry module inside the extraction dir, refusing any path that escapes it.
+ *  The control plane validates `entry` at deploy, but a self-hosted runner may be pointed at an
+ *  arbitrary control plane, so this is defense-in-depth: an absolute path or a `..` that resolves
+ *  outside `dir` throws rather than importing code from elsewhere on the machine. */
+export declare function resolveEntryPath(dir: string, entry: string): string;
 export interface RunProgramArgs {
     /** Run id — used for the temp dir path + correlation. */
     runId: string;

package/dist/runtime/program_runner.js

@@ -21,7 +21,7 @@
 // (no checkpoint, no exit). A crash mid-run restarts the run from the top (handled by the
 // worker/scheduler-sweep, not here). Output capture is deferred (v0 returns null).
 import { mkdir, writeFile, rm, symlink, lstat } from "node:fs/promises";
-import { dirname, join } from "node:path";
+import { dirname, join, isAbsolute, relative, sep } from "node:path";
 import { createRequire } from "node:module";
 import { pathToFileURL } from "node:url";
 import { randomUUID } from "node:crypto";
@@ -69,6 +69,18 @@ export async function ensureSdkLink(execDir) {
         }
     }
 }
+/** Resolve the program's entry module inside the extraction dir, refusing any path that escapes it.
+ *  The control plane validates `entry` at deploy, but a self-hosted runner may be pointed at an
+ *  arbitrary control plane, so this is defense-in-depth: an absolute path or a `..` that resolves
+ *  outside `dir` throws rather than importing code from elsewhere on the machine. */
+export function resolveEntryPath(dir, entry) {
+    const resolved = join(dir, ...entry.split("/"));
+    const rel = relative(dir, resolved);
+    if (isAbsolute(entry) || rel === "" || rel.startsWith("..") || rel.startsWith(`..${sep}`)) {
+        throw new AppError(ErrorCode.VALIDATION_FAILED, `Program entry "${entry}" escapes the program directory.`);
+    }
+    return resolved;
+}
 /** Scratch filename for the in-flight artifact tarball inside a run's dir. */
 const ARTIFACT_FILE = "__program.tgz";
 /**
@@ -96,7 +108,10 @@ export async function runWorkflowProgram(args, deps) {
         // Make the bare `@boardwalk-labs/workflow` import resolve from ANY work root — hosted images
         // provide it via an ancestor node_modules, but a self-hosted daemon's workspace has none.
         await ensureSdkLink(dir);
-        const entryPath = join(dir, ...args.entry.split("/"));
+        // Re-validate the entry here even though the control plane checked it at deploy: a self-hosted
+        // runner may point at an arbitrary control plane, so refuse an entry that could escape the
+        // extraction dir (absolute path or `..` segment) before importing it.
+        const entryPath = resolveEntryPath(dir, args.entry);
         // Run the program body. A SUSPEND is surfaced two ways and both land here as a `suspended`
         // result: (a) out of band via `suspendSignal` — racing the body, immune to a program's own
         // try/catch (the suspending seam never resolves); (b) a thrown {@link SuspendError} on the

package/dist/runtime/program_worker.js

@@ -162,7 +162,9 @@ export async function runProgramWorker(runId, deps) {
     // by `flushFinal()` after the body (on every path except a lease_lost handoff).
     const runtimeFlush = deps.startRuntimeFlush?.({ run: claimed, startedAtMs: sessionStartMs });
     // Capture the program's console.* as `log` run-events for the duration of the body (best-effort).
-    const restoreConsole = deps.onProgramLog !== undefined ? captureConsole(deps.onProgramLog) : () => undefined;
+    const restoreConsole = deps.onProgramLog !== undefined
+        ? captureConsole(deps.onProgramLog, (text) => redactor.redactText(text))
+        : () => undefined;
     let result;
     try {
         result = await runWorkflowProgram({

package/dist/runtime/workspace_store.js

@@ -13,6 +13,8 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { stat, mkdir, readFile, writeFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
 import { createLogger } from "./support/index.js";
 const log = createLogger("WorkspaceStore");
 const exec = promisify(execFile);
@@ -30,7 +32,12 @@ export class WorkspaceStore {
     maxSnapshotBytes;
     constructor(deps) {
         this.deps = deps;
-        this.tmpPath = deps.tmpPath ?? "/tmp/workspace-snapshot.tgz";
+        // Scratch tarball path. Default to os.tmpdir() (which honors TMPDIR) rather than a machine-global
+        // `/tmp/workspace-snapshot.tgz`: on a self-hosted runner the daemon points TMPDIR at the PER-RUN
+        // dir, so the snapshot can't collide between concurrent daemons and doesn't sit in world-shared
+        // `/tmp` where the crashed-window archive of a whole workspace would be readable. On the hosted
+        // single-tenant worker it's the container's own `/tmp` (one run per container).
+        this.tmpPath = deps.tmpPath ?? join(tmpdir(), "bw-workspace-snapshot.tgz");
         this.maxSnapshotBytes = deps.maxSnapshotBytes ?? WORKSPACE_SNAPSHOT_MAX_BYTES;
     }
     /** Restore the workflow's last `/workspace` snapshot at run start. No-op (logged) on any failure or
@@ -43,6 +50,7 @@ export class WorkspaceStore {
             const bytes = await this.deps.broker.downloadBytes(url);
             if (bytes === null)
                 return; // 404 — no snapshot yet (the workflow's first run)
+            await mkdir(dirname(this.tmpPath), { recursive: true }); // per-run TMPDIR may not exist yet
             await this.deps.fs.writeFile(this.tmpPath, bytes);
             await this.deps.archiver.extract(this.tmpPath, this.deps.workspaceRoot);
             await this.deps.fs.rm(this.tmpPath);
@@ -62,6 +70,7 @@ export class WorkspaceStore {
      *  only redundant archive is a self-hosted+persist run, where the broker returns a null URL. */
     async persist() {
         try {
+            await mkdir(dirname(this.tmpPath), { recursive: true }); // per-run TMPDIR may not exist yet
             const size = await this.deps.archiver.archive(this.deps.workspaceRoot, this.tmpPath);
             // Guardrail: an oversized snapshot is dropped (logged), never read into memory or uploaded — the
             // workflow re-does filesystem work next run, as it would without persistence. Checked on the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boardwalk-labs/runner",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Boardwalk self-hosted runner: execute cloud-scheduled runs on your own machines. Currently: the canonical runner contract types.",
   "license": "Apache-2.0",
   "repository": {