@boardwalk-labs/runner 0.1.6 → 0.1.8

package/dist/daemon/identity.js

@@ -2,10 +2,20 @@
 // Persisted runner identity — the standing credential + coordinates a machine keeps between
 // restarts (`runner start` after a reboot skips registration). One JSON file per
 // (control plane, pool), mode 0600: the runner token is a credential.
-import { mkdir, readFile, writeFile, unlink } from "node:fs/promises";
+import { mkdir, readFile, writeFile, unlink, chmod } from "node:fs/promises";
 import * as path from "node:path";
 import * as os from "node:os";
 import { z } from "zod";
+/** Re-assert restrictive perms on a path (POSIX only). `mkdir`/`writeFile` set mode only when they
+ *  CREATE, so a pre-existing dir/file could be group/world-readable; this makes the credential
+ *  fail-safe regardless. No-op on Windows (no POSIX mode bits). Best-effort — a chmod failure must
+ *  not break enrollment. NOTE: this hardens the file at rest; it does NOT stop a same-UID process
+ *  (an in-process run program) from reading it — that requires per-run UID/container isolation. */
+async function hardenPerms(target, mode) {
+    if (process.platform === "win32")
+        return;
+    await chmod(target, mode).catch(() => undefined);
+}
 export const runnerIdentitySchema = z.strictObject({
     runner_id: z.string().min(1),
     runner_token: z.string().min(1),
@@ -25,15 +35,21 @@ function identityFile(dir, controlPlaneUrl, pool) {
 }
 export async function saveIdentity(dir, identity) {
     await mkdir(dir, { recursive: true, mode: 0o700 });
+    await hardenPerms(dir, 0o700); // re-assert: mkdir's mode only applies when it CREATES the dir
     const file = identityFile(dir, identity.control_plane_url, identity.pool);
     await writeFile(file, `${JSON.stringify(identity, null, 2)}\n`, { mode: 0o600 });
+    await hardenPerms(file, 0o600); // re-assert: writeFile's mode only applies to a NEW file
     return file;
 }
 export async function loadIdentity(dir, controlPlaneUrl, pool) {
     try {
-        const raw = await readFile(identityFile(dir, controlPlaneUrl, pool), "utf8");
+        const file = identityFile(dir, controlPlaneUrl, pool);
+        const raw = await readFile(file, "utf8");
         const parsed = runnerIdentitySchema.safeParse(JSON.parse(raw));
-        return parsed.success ? parsed.data : null;
+        if (!parsed.success)
+            return null;
+        await hardenPerms(file, 0o600); // repair perms if something loosened them since save
+        return parsed.data;
     }
     catch {
         return null;

package/dist/runtime/program_runner.d.ts

@@ -10,6 +10,11 @@ import { type SuspendSignal } from "./suspension.js";
  * still exist.
  */
 export declare function ensureSdkLink(execDir: string): Promise<void>;
+/** Resolve the program's entry module inside the extraction dir, refusing any path that escapes it.
+ *  The control plane validates `entry` at deploy, but a self-hosted runner may be pointed at an
+ *  arbitrary control plane, so this is defense-in-depth: an absolute path or a `..` that resolves
+ *  outside `dir` throws rather than importing code from elsewhere on the machine. */
+export declare function resolveEntryPath(dir: string, entry: string): string;
 export interface RunProgramArgs {
     /** Run id — used for the temp dir path + correlation. */
     runId: string;

package/dist/runtime/program_runner.js

@@ -21,7 +21,7 @@
 // (no checkpoint, no exit). A crash mid-run restarts the run from the top (handled by the
 // worker/scheduler-sweep, not here). Output capture is deferred (v0 returns null).
 import { mkdir, writeFile, rm, symlink, lstat } from "node:fs/promises";
-import { dirname, join } from "node:path";
+import { dirname, join, isAbsolute, relative, sep } from "node:path";
 import { createRequire } from "node:module";
 import { pathToFileURL } from "node:url";
 import { randomUUID } from "node:crypto";
@@ -69,6 +69,18 @@ export async function ensureSdkLink(execDir) {
         }
     }
 }
+/** Resolve the program's entry module inside the extraction dir, refusing any path that escapes it.
+ *  The control plane validates `entry` at deploy, but a self-hosted runner may be pointed at an
+ *  arbitrary control plane, so this is defense-in-depth: an absolute path or a `..` that resolves
+ *  outside `dir` throws rather than importing code from elsewhere on the machine. */
+export function resolveEntryPath(dir, entry) {
+    const resolved = join(dir, ...entry.split("/"));
+    const rel = relative(dir, resolved);
+    if (isAbsolute(entry) || rel === "" || rel.startsWith("..") || rel.startsWith(`..${sep}`)) {
+        throw new AppError(ErrorCode.VALIDATION_FAILED, `Program entry "${entry}" escapes the program directory.`);
+    }
+    return resolved;
+}
 /** Scratch filename for the in-flight artifact tarball inside a run's dir. */
 const ARTIFACT_FILE = "__program.tgz";
 /**
@@ -96,7 +108,10 @@ export async function runWorkflowProgram(args, deps) {
         // Make the bare `@boardwalk-labs/workflow` import resolve from ANY work root — hosted images
         // provide it via an ancestor node_modules, but a self-hosted daemon's workspace has none.
         await ensureSdkLink(dir);
-        const entryPath = join(dir, ...args.entry.split("/"));
+        // Re-validate the entry here even though the control plane checked it at deploy: a self-hosted
+        // runner may point at an arbitrary control plane, so refuse an entry that could escape the
+        // extraction dir (absolute path or `..` segment) before importing it.
+        const entryPath = resolveEntryPath(dir, args.entry);
         // Run the program body. A SUSPEND is surfaced two ways and both land here as a `suspended`
         // result: (a) out of band via `suspendSignal` — racing the body, immune to a program's own
         // try/catch (the suspending seam never resolves); (b) a thrown {@link SuspendError} on the

package/dist/runtime/workspace_store.js

@@ -13,6 +13,9 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { stat, mkdir, readFile, writeFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { extract as tarExtract } from "tar";
 import { createLogger } from "./support/index.js";
 const log = createLogger("WorkspaceStore");
 const exec = promisify(execFile);
@@ -30,7 +33,12 @@ export class WorkspaceStore {
     maxSnapshotBytes;
     constructor(deps) {
         this.deps = deps;
-        this.tmpPath = deps.tmpPath ?? "/tmp/workspace-snapshot.tgz";
+        // Scratch tarball path. Default to os.tmpdir() (which honors TMPDIR) rather than a machine-global
+        // `/tmp/workspace-snapshot.tgz`: on a self-hosted runner the daemon points TMPDIR at the PER-RUN
+        // dir, so the snapshot can't collide between concurrent daemons and doesn't sit in world-shared
+        // `/tmp` where the crashed-window archive of a whole workspace would be readable. On the hosted
+        // single-tenant worker it's the container's own `/tmp` (one run per container).
+        this.tmpPath = deps.tmpPath ?? join(tmpdir(), "bw-workspace-snapshot.tgz");
         this.maxSnapshotBytes = deps.maxSnapshotBytes ?? WORKSPACE_SNAPSHOT_MAX_BYTES;
     }
     /** Restore the workflow's last `/workspace` snapshot at run start. No-op (logged) on any failure or
@@ -43,6 +51,7 @@ export class WorkspaceStore {
             const bytes = await this.deps.broker.downloadBytes(url);
             if (bytes === null)
                 return; // 404 — no snapshot yet (the workflow's first run)
+            await mkdir(dirname(this.tmpPath), { recursive: true }); // per-run TMPDIR may not exist yet
             await this.deps.fs.writeFile(this.tmpPath, bytes);
             await this.deps.archiver.extract(this.tmpPath, this.deps.workspaceRoot);
             await this.deps.fs.rm(this.tmpPath);
@@ -62,6 +71,7 @@ export class WorkspaceStore {
      *  only redundant archive is a self-hosted+persist run, where the broker returns a null URL. */
     async persist() {
         try {
+            await mkdir(dirname(this.tmpPath), { recursive: true }); // per-run TMPDIR may not exist yet
             const size = await this.deps.archiver.archive(this.deps.workspaceRoot, this.tmpPath);
             // Guardrail: an oversized snapshot is dropped (logged), never read into memory or uploaded — the
             // workflow re-does filesystem work next run, as it would without persistence. Checked on the
@@ -98,7 +108,13 @@ export class TarWorkspaceArchiver {
     }
     async extract(srcPath, dir) {
         await mkdir(dir, { recursive: true });
-        await exec("tar", ["xzf", srcPath, "-C", dir]);
+        // Extract via node-tar, NOT `tar xzf`: extraction reads UNTRUSTED input (a program artifact
+        // from an arbitrary control plane on a self-hosted runner, or a prior run's workspace snapshot),
+        // and node-tar is hardened + portable — with default `preservePaths: false` it strips absolute
+        // paths and `..` members, and refuses to write THROUGH a symlink (unlinking it first), closing
+        // the traversal/symlink-escape gaps that differ between GNU tar and bsdtar. Same behavior on
+        // macOS and Linux, no dependency on which `tar` the OS ships.
+        await tarExtract({ file: srcPath, cwd: dir });
     }
 }
 /** Production fs — node's fs/promises. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boardwalk-labs/runner",
-  "version": "0.1.6",
+  "version": "0.1.8",
   "description": "Boardwalk self-hosted runner: execute cloud-scheduled runs on your own machines. Currently: the canonical runner contract types.",
   "license": "Apache-2.0",
   "repository": {