@melaya/runner 1.1.53 → 1.1.55

package/dist/connection.js

@@ -32,6 +32,13 @@ import { startBrowserBridge } from "./browserBridge.js";
 import { verifyBrowserGrant, createInMemoryReplayStore, loadPinnedPublicKeysFromEnv, BrowserGrantError, } from "./browserGrantVerify.js";
 import { discoverEngines } from "./browserProvisioner.js";
 import { getRunnerDeviceId } from "./sessionManager.js";
+import { scrubTriggeredEnv } from "./triggerEnv.js";
+// Same ceiling the builder enforces on RunRequest.trigger (48 KB UTF-8 of the
+// compact JSON) and the server dispatch route re-checks (Buffer.byteLength).
+const MAX_TRIGGER_JSON_BYTES = 48 * 1024;
+// Advertised in runner:hello; must match server runnerNamespace
+// EVENT_TRIGGERS_CAPABILITY.
+const EVENT_TRIGGERS_CAPABILITY = "event_triggers_v1";
 const HEARTBEAT_INTERVAL = 30_000;
 const activeProcesses = new Map();
 // Melaya Browser: the versioned capability advertised in the runner hello
@@ -271,7 +278,10 @@ export async function connect(opts) {
         // to runners new enough to host them (older runners never get one → the
         // server falls back with a clear "update your runner" instead of hanging).
         socket.emit("runner:hello", {
-            capabilities: ["assistant_session", `browser_control_v${BROWSER_CONTROL_VERSION}`],
+            // event_triggers_v1: this runner writes payload.triggerJson to
+            // <runDir>/trigger.json + MEL_TRIGGER_FILE. The server reports
+            // triggerAccepted from it; older runners silently drop the block.
+            capabilities: ["assistant_session", `browser_control_v${BROWSER_CONTROL_VERSION}`, EVENT_TRIGGERS_CAPABILITY],
             package: "@melaya/runner",
             version: RUNNER_VERSION,
             assistantProtocol: ASSISTANT_PROTOCOL_VERSION,
@@ -631,12 +641,51 @@ export async function connect(opts) {
                 runId: payload.runId,
                 project: payload.project,
                 pipelineName: payload.pipelineName,
+                ...(typeof payload.openedFrom === "string" && /^[a-z][a-z_]{0,15}$/.test(payload.openedFrom)
+                    ? { openedFrom: payload.openedFrom }
+                    : {}),
             });
             // Write main.py to temp dir
             const runDir = join(tmpdir(), `melaya-run-${payload.runId}`);
             mkdirSync(runDir, { recursive: true });
             writeFileSync(join(runDir, "main.py"), payload.mainPyContent, "utf-8");
             writeFileSync(join(runDir, "config.json"), payload.configJson, "utf-8");
+            // Event-trigger payload → <runDir>/trigger.json (MEL_TRIGGER_FILE below).
+            // Size-capped + must parse as a JSON object; anything else is dropped
+            // (the run still starts, just without the trigger block).
+            let triggerFile = "";
+            // ST-24: a run is TRIGGERED as soon as the dispatch carries triggerJson
+            // at all (even an oversize / corrupt one that is dropped below): the env
+            // scrub keys on this, never on whether trigger.json got written.
+            const isTriggeredRun = payload.triggerJson !== undefined && payload.triggerJson !== null;
+            // EXT-17 / J8: the trigger may opt in to keep the egress/residential
+            // proxy for this run (never the account key). Only a well-formed block
+            // can opt in; a corrupt one keeps the strict default.
+            let triggerAllowsProxy = false;
+            // ST-15 / J9: in-run HITL TTL of the triggered run (seconds).
+            let triggerApprovalTtl = 3600;
+            if (typeof payload.triggerJson === "string" && payload.triggerJson) {
+                try {
+                    if (Buffer.byteLength(payload.triggerJson, "utf-8") > MAX_TRIGGER_JSON_BYTES) {
+                        throw new Error("trigger payload exceeds 48 KB");
+                    }
+                    const parsed = JSON.parse(payload.triggerJson);
+                    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+                        throw new Error("trigger payload is not a JSON object");
+                    }
+                    triggerAllowsProxy = parsed.allow_egress_proxy === true;
+                    if (Number.isInteger(parsed.approval_ttl_s)) {
+                        triggerApprovalTtl = Math.max(60, Math.min(86_400, parsed.approval_ttl_s));
+                    }
+                    triggerFile = join(runDir, "trigger.json");
+                    // 0600: attacker-influenceable payload, readable by the run only.
+                    writeFileSync(triggerFile, payload.triggerJson, { encoding: "utf-8", mode: 0o600 });
+                }
+                catch (e) {
+                    triggerFile = "";
+                    console.log(chalk.yellow(`  ! trigger payload ignored for run ${payload.runId}: ${e.message}`));
+                }
+            }
             // Write rag/ static-context files alongside main.py so
             // _load_rag_context() inside the spawned pipeline sees them.
             // Two paths:
@@ -756,6 +805,19 @@ export async function connect(opts) {
                 if (k.startsWith("MEL_MODEL_"))
                     delete inherited[k];
             }
+            // Event triggers: MEL_TRIGGER_FILE is runner-owned (set below). For a
+            // TRIGGERED run also drop the operator's shell-exported full-account key
+            // and proxy credentials (brief section 7) - the payload is untrusted.
+            delete inherited.MEL_TRIGGER_FILE;
+            delete inherited.MEL_HITL_APPROVAL_TTL_S;
+            // Triggered-run credential bundle: the account key never reaches the run
+            // in ANY alias (ST-03: MELAYA_API_KEY, PLATFORM_API_<digest>, or any other
+            // key carrying the same value), and no proxy creds unless opted in (J8).
+            // The builder already strips these; this is the runner-side backstop.
+            const runCredentials = { ...(payload.credentials || {}) };
+            if (isTriggeredRun) {
+                scrubTriggeredEnv(inherited, runCredentials, triggerAllowsProxy);
+            }
             // Reserved browser bridge env names are runner-owned and injected
             // LAST below (plan Section 4). Scrub any operator-exported value so
             // a stale/hostile MEL_BROWSER_* in the shell can't shadow ours.
@@ -813,8 +875,16 @@ export async function connect(opts) {
                     }
                     return dir;
                 })(),
-                // Inject per-pipeline credentials (already scoped by the server)
-                ...payload.credentials,
+                // Inject per-pipeline credentials (already scoped by the server;
+                // scrubbed above for a triggered run)
+                ...runCredentials,
+                // laya-local (decide_* tools): the runner can't reach the box's private
+                // 127.0.0.1:8770, so point LAYA_LOCAL_URL at the server's PER-USER-gated
+                // proxy. AFTER the credential spread so it can't be overridden. The proxy
+                // authenticates with this run's signed MEL_RUN_TOKEN (already in
+                // payload.credentials) - never a shared secret - and meters per user.
+                LAYA_LOCAL_URL: opts.serverUrl.replace(/^wss:/, "https:").replace(/^ws:/, "http:").replace(/\/$/, "") +
+                    "/api/v1/internal/laya",
                 // If a Luma browser bridge is up (i.e. the user has signed in
                 // via this runner), inject its localhost URL + bearer token so
                 // shared/tools/luma.py routes /event/register through Playwright
@@ -854,6 +924,18 @@ export async function connect(opts) {
                 ...(browserToken && browserBridge
                     ? { MEL_BROWSER_URL: browserBridge.url, MEL_BROWSER_TOKEN: browserToken }
                     : {}),
+                // Event trigger file (reserved: after the credential spread so a
+                // credential can never point it elsewhere). Empty string = no trigger.
+                MEL_TRIGGER_FILE: triggerFile,
+                // Triggered run: forced-safe HITL + expiring in-run approvals (ST-15),
+                // also reserved (after the credential spread).
+                ...(isTriggeredRun
+                    ? {
+                        MEL_HITL_MODE: "safe",
+                        MEL_HITL_FORCE_SAFE: "1",
+                        MEL_HITL_APPROVAL_TTL_S: String(triggerApprovalTtl),
+                    }
+                    : {}),
             };
             // Surface the tier to the chat panel as a system message so the
             // operator sees WHY a small model is running with tighter caps.
@@ -1680,6 +1762,12 @@ export async function connect(opts) {
                     : {}),
                 // Per-user creds (incl. MELAYA_API_KEY + the selected connectors' env).
                 ...(payload.credentials || {}),
+                // laya-local (decide_* built-in tools, always-on core): the runner can't
+                // see the box's private 127.0.0.1:8770, so point LAYA_LOCAL_URL at the
+                // server's PER-USER-gated proxy. AFTER creds so it can't be overridden.
+                // The proxy authenticates with this user's MELAYA_API_KEY (in the
+                // projected creds) - never a shared secret - and meters per user.
+                LAYA_LOCAL_URL: httpBase.replace(/\/$/, "") + "/api/v1/internal/laya",
             };
             const session = launchAssistantHost({
                 env, pythonPath: envResult.pythonPath, workDir, stagedHost,

package/dist/triggerEnv.d.ts

@@ -0,0 +1,3 @@
+export declare const TRIGGER_PROXY_ENV: readonly ["EGRESS_PROXY_URL", "MEL_RESIDENTIAL_PROXY_URL"];
+/** Mutates both maps in place. */
+export declare function scrubTriggeredEnv(inherited: Record<string, string | undefined>, credentials: Record<string, string | undefined>, allowEgressProxy: boolean): void;

package/dist/triggerEnv.js

@@ -0,0 +1,37 @@
+// Env hardening for TRIGGERED pipeline runs (Obsidian 37 Event Triggers).
+//
+// A run started by an event trigger processes an attacker-influenceable
+// payload, so an injected tool call (bash `env`, an http tool) must not be able
+// to read the account key or the residential proxy credentials:
+//   * the account key in ANY alias: MELAYA_API_KEY, PLATFORM_API_<digest> (the
+//     mangled credential-row copy, audit ST-03), or any other variable whose
+//     value equals one of those;
+//   * EGRESS_PROXY_URL / MEL_RESIDENTIAL_PROXY_URL unless the trigger opted in
+//     with allow_egress_proxy (EXT-17 / J8).
+// Applied to BOTH the runner's inherited shell env and the server-shipped
+// credential bundle (the builder strips the bundle too; this is the backstop).
+export const TRIGGER_PROXY_ENV = ["EGRESS_PROXY_URL", "MEL_RESIDENTIAL_PROXY_URL"];
+function isAccountKeyName(k) {
+    return k === "MELAYA_API_KEY" || k.startsWith("PLATFORM_API_");
+}
+/** Mutates both maps in place. */
+export function scrubTriggeredEnv(inherited, credentials, allowEgressProxy) {
+    const keyValues = new Set();
+    for (const src of [inherited, credentials]) {
+        for (const [k, v] of Object.entries(src)) {
+            if (isAccountKeyName(k) && typeof v === "string" && v.length >= 8)
+                keyValues.add(v);
+        }
+    }
+    for (const src of [inherited, credentials]) {
+        for (const k of Object.keys(src)) {
+            const v = src[k];
+            if (isAccountKeyName(k))
+                delete src[k];
+            else if (!allowEgressProxy && TRIGGER_PROXY_ENV.includes(k))
+                delete src[k];
+            else if (typeof v === "string" && keyValues.has(v))
+                delete src[k];
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@melaya/runner",
-  "version": "1.1.53",
+  "version": "1.1.55",
   "description": "Run Melaya AI pipelines locally with your own LM Studio or Ollama models",
   "license": "Apache-2.0",
   "author": "Melaya Labs LLC",