@boardwalk-labs/runner 0.1.6 → 0.1.7

package/dist/runtime/program_runner.d.ts

@@ -10,6 +10,11 @@ import { type SuspendSignal } from "./suspension.js";
  * still exist.
  */
 export declare function ensureSdkLink(execDir: string): Promise<void>;
+/** Resolve the program's entry module inside the extraction dir, refusing any path that escapes it.
+ *  The control plane validates `entry` at deploy, but a self-hosted runner may be pointed at an
+ *  arbitrary control plane, so this is defense-in-depth: an absolute path or a `..` that resolves
+ *  outside `dir` throws rather than importing code from elsewhere on the machine. */
+export declare function resolveEntryPath(dir: string, entry: string): string;
 export interface RunProgramArgs {
     /** Run id — used for the temp dir path + correlation. */
     runId: string;

package/dist/runtime/program_runner.js

@@ -21,7 +21,7 @@
 // (no checkpoint, no exit). A crash mid-run restarts the run from the top (handled by the
 // worker/scheduler-sweep, not here). Output capture is deferred (v0 returns null).
 import { mkdir, writeFile, rm, symlink, lstat } from "node:fs/promises";
-import { dirname, join } from "node:path";
+import { dirname, join, isAbsolute, relative, sep } from "node:path";
 import { createRequire } from "node:module";
 import { pathToFileURL } from "node:url";
 import { randomUUID } from "node:crypto";
@@ -69,6 +69,18 @@ export async function ensureSdkLink(execDir) {
         }
     }
 }
+/** Resolve the program's entry module inside the extraction dir, refusing any path that escapes it.
+ *  The control plane validates `entry` at deploy, but a self-hosted runner may be pointed at an
+ *  arbitrary control plane, so this is defense-in-depth: an absolute path or a `..` that resolves
+ *  outside `dir` throws rather than importing code from elsewhere on the machine. */
+export function resolveEntryPath(dir, entry) {
+    const resolved = join(dir, ...entry.split("/"));
+    const rel = relative(dir, resolved);
+    if (isAbsolute(entry) || rel === "" || rel.startsWith("..") || rel.startsWith(`..${sep}`)) {
+        throw new AppError(ErrorCode.VALIDATION_FAILED, `Program entry "${entry}" escapes the program directory.`);
+    }
+    return resolved;
+}
 /** Scratch filename for the in-flight artifact tarball inside a run's dir. */
 const ARTIFACT_FILE = "__program.tgz";
 /**
@@ -96,7 +108,10 @@ export async function runWorkflowProgram(args, deps) {
         // Make the bare `@boardwalk-labs/workflow` import resolve from ANY work root — hosted images
         // provide it via an ancestor node_modules, but a self-hosted daemon's workspace has none.
         await ensureSdkLink(dir);
-        const entryPath = join(dir, ...args.entry.split("/"));
+        // Re-validate the entry here even though the control plane checked it at deploy: a self-hosted
+        // runner may point at an arbitrary control plane, so refuse an entry that could escape the
+        // extraction dir (absolute path or `..` segment) before importing it.
+        const entryPath = resolveEntryPath(dir, args.entry);
         // Run the program body. A SUSPEND is surfaced two ways and both land here as a `suspended`
         // result: (a) out of band via `suspendSignal` — racing the body, immune to a program's own
         // try/catch (the suspending seam never resolves); (b) a thrown {@link SuspendError} on the

package/dist/runtime/workspace_store.js

@@ -13,6 +13,8 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { stat, mkdir, readFile, writeFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
 import { createLogger } from "./support/index.js";
 const log = createLogger("WorkspaceStore");
 const exec = promisify(execFile);
@@ -30,7 +32,12 @@ export class WorkspaceStore {
     maxSnapshotBytes;
     constructor(deps) {
         this.deps = deps;
-        this.tmpPath = deps.tmpPath ?? "/tmp/workspace-snapshot.tgz";
+        // Scratch tarball path. Default to os.tmpdir() (which honors TMPDIR) rather than a machine-global
+        // `/tmp/workspace-snapshot.tgz`: on a self-hosted runner the daemon points TMPDIR at the PER-RUN
+        // dir, so the snapshot can't collide between concurrent daemons and doesn't sit in world-shared
+        // `/tmp` where the crashed-window archive of a whole workspace would be readable. On the hosted
+        // single-tenant worker it's the container's own `/tmp` (one run per container).
+        this.tmpPath = deps.tmpPath ?? join(tmpdir(), "bw-workspace-snapshot.tgz");
         this.maxSnapshotBytes = deps.maxSnapshotBytes ?? WORKSPACE_SNAPSHOT_MAX_BYTES;
     }
     /** Restore the workflow's last `/workspace` snapshot at run start. No-op (logged) on any failure or
@@ -43,6 +50,7 @@ export class WorkspaceStore {
             const bytes = await this.deps.broker.downloadBytes(url);
             if (bytes === null)
                 return; // 404 — no snapshot yet (the workflow's first run)
+            await mkdir(dirname(this.tmpPath), { recursive: true }); // per-run TMPDIR may not exist yet
             await this.deps.fs.writeFile(this.tmpPath, bytes);
             await this.deps.archiver.extract(this.tmpPath, this.deps.workspaceRoot);
             await this.deps.fs.rm(this.tmpPath);
@@ -62,6 +70,7 @@ export class WorkspaceStore {
      *  only redundant archive is a self-hosted+persist run, where the broker returns a null URL. */
     async persist() {
         try {
+            await mkdir(dirname(this.tmpPath), { recursive: true }); // per-run TMPDIR may not exist yet
             const size = await this.deps.archiver.archive(this.deps.workspaceRoot, this.tmpPath);
             // Guardrail: an oversized snapshot is dropped (logged), never read into memory or uploaded — the
             // workflow re-does filesystem work next run, as it would without persistence. Checked on the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boardwalk-labs/runner",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Boardwalk self-hosted runner: execute cloud-scheduled runs on your own machines. Currently: the canonical runner contract types.",
   "license": "Apache-2.0",
   "repository": {