@multiplier-labs/stepflow 0.3.3 → 0.3.4

package/src/planning/evaluate-condition.ts

@@ -0,0 +1,105 @@
+/**
+ * Shared condition evaluation helpers used by the planner and registry.
+ *
+ * Extracted to a single module so the planner's recipe scoring and the
+ * registry's `query({ matchConditions })` filter cannot drift apart.
+ */
+
+import RE2 from 're2';
+import type { ConditionOperator } from './types';
+
+/**
+ * Maximum length (in characters) accepted for a `matches` regex pattern.
+ *
+ * Recipe conditions can come from user-supplied configuration; even with RE2's
+ * linear-time guarantee, very large patterns waste CPU/memory at compile time
+ * and inflate the per-evaluation cost. Cap the source length so a pathological
+ * recipe cannot hand the planner a megabyte of regex.
+ */
+export const MAX_REGEX_PATTERN_LENGTH = 512;
+
+/**
+ * Get a nested value from an object using dot notation.
+ */
+export function getNestedValue(
+  obj: Record<string, unknown>,
+  path: string
+): unknown {
+  return path.split('.').reduce<unknown>((current, key) => {
+    if (current && typeof current === 'object' && key in current) {
+      return (current as Record<string, unknown>)[key];
+    }
+    return undefined;
+  }, obj);
+}
+
+/**
+ * Evaluate a single condition against a value.
+ *
+ * The `matches` operator uses RE2 (not the JS RegExp engine) to avoid
+ * catastrophic-backtracking DoS from untrusted recipe inputs.
+ */
+export function evaluateCondition(
+  operator: ConditionOperator,
+  fieldValue: unknown,
+  conditionValue: unknown
+): boolean {
+  switch (operator) {
+    case 'eq':
+      return fieldValue === conditionValue;
+
+    case 'neq':
+      return fieldValue !== conditionValue;
+
+    case 'gt':
+      return typeof fieldValue === 'number' && typeof conditionValue === 'number'
+        ? fieldValue > conditionValue
+        : false;
+
+    case 'gte':
+      return typeof fieldValue === 'number' && typeof conditionValue === 'number'
+        ? fieldValue >= conditionValue
+        : false;
+
+    case 'lt':
+      return typeof fieldValue === 'number' && typeof conditionValue === 'number'
+        ? fieldValue < conditionValue
+        : false;
+
+    case 'lte':
+      return typeof fieldValue === 'number' && typeof conditionValue === 'number'
+        ? fieldValue <= conditionValue
+        : false;
+
+    case 'contains':
+      if (typeof fieldValue === 'string' && typeof conditionValue === 'string') {
+        return fieldValue.includes(conditionValue);
+      }
+      if (Array.isArray(fieldValue)) {
+        return fieldValue.includes(conditionValue);
+      }
+      return false;
+
+    case 'matches':
+      if (typeof fieldValue === 'string' && typeof conditionValue === 'string') {
+        if (conditionValue.length > MAX_REGEX_PATTERN_LENGTH) {
+          return false;
+        }
+        try {
+          return new RE2(conditionValue).test(fieldValue);
+        } catch {
+          return false;
+        }
+      }
+      return false;
+
+    case 'exists':
+      return fieldValue !== undefined && fieldValue !== null && fieldValue !== '';
+
+    case 'notExists':
+      return fieldValue === undefined || fieldValue === null || fieldValue === '';
+
+    default:
+      return false;
+  }
+}

package/src/planning/planner.ts

@@ -3,10 +3,9 @@
  * Selects recipes and generates plans based on conditions and input analysis.
  */
 
-import RE2 from 're2';
 import { generateId } from '../utils/id';
+import { evaluateCondition, getNestedValue } from './evaluate-condition';
 import type {
-  ConditionOperator,
   Plan,
   PlannedStep,
   Planner,
@@ -22,87 +21,6 @@ import type {
   WorkflowKind,
 } from './types';
 
-// ============================================================================
-// Condition Evaluation
-// ============================================================================
-
-/**
- * Get a nested value from an object using dot notation.
- */
-function getNestedValue(obj: Record<string, unknown>, path: string): unknown {
-  return path.split('.').reduce<unknown>((current, key) => {
-    if (current && typeof current === 'object' && key in current) {
-      return (current as Record<string, unknown>)[key];
-    }
-    return undefined;
-  }, obj);
-}
-
-/**
- * Evaluate a single condition against a value.
- */
-function evaluateCondition(
-  operator: ConditionOperator,
-  fieldValue: unknown,
-  conditionValue: unknown
-): boolean {
-  switch (operator) {
-    case 'eq':
-      return fieldValue === conditionValue;
-
-    case 'neq':
-      return fieldValue !== conditionValue;
-
-    case 'gt':
-      return typeof fieldValue === 'number' && typeof conditionValue === 'number'
-        ? fieldValue > conditionValue
-        : false;
-
-    case 'gte':
-      return typeof fieldValue === 'number' && typeof conditionValue === 'number'
-        ? fieldValue >= conditionValue
-        : false;
-
-    case 'lt':
-      return typeof fieldValue === 'number' && typeof conditionValue === 'number'
-        ? fieldValue < conditionValue
-        : false;
-
-    case 'lte':
-      return typeof fieldValue === 'number' && typeof conditionValue === 'number'
-        ? fieldValue <= conditionValue
-        : false;
-
-    case 'contains':
-      if (typeof fieldValue === 'string' && typeof conditionValue === 'string') {
-        return fieldValue.includes(conditionValue);
-      }
-      if (Array.isArray(fieldValue)) {
-        return fieldValue.includes(conditionValue);
-      }
-      return false;
-
-    case 'matches':
-      if (typeof fieldValue === 'string' && typeof conditionValue === 'string') {
-        try {
-          return new RE2(conditionValue).test(fieldValue);
-        } catch {
-          return false;
-        }
-      }
-      return false;
-
-    case 'exists':
-      return fieldValue !== undefined && fieldValue !== null && fieldValue !== '';
-
-    case 'notExists':
-      return fieldValue === undefined || fieldValue === null || fieldValue === '';
-
-    default:
-      return false;
-  }
-}
-
 /**
  * Score a recipe's conditions against input.
  * Returns a score from 0-100 based on how well conditions match.

package/src/planning/registry.ts

@@ -3,11 +3,10 @@
  * Provides storage and retrieval of recipes and handlers.
  */
 
-import RE2 from 're2';
 import type { WorkflowStep } from '../core/types';
+import { evaluateCondition, getNestedValue } from './evaluate-condition';
 import type {
   Recipe,
-  RecipeCondition,
   RecipeRegistry,
   RecipeQueryOptions,
   RegisteredStepHandler,
@@ -247,9 +246,6 @@ export class MemoryRecipeRegistry implements RecipeRegistry {
   /**
    * Evaluate recipe conditions against an input.
    * Returns true if all conditions match.
-   *
-   * Note: This intentionally mirrors the condition evaluation in planner.ts
-   * to keep registry queries independent of the planner implementation.
    */
   private evaluateConditions(
     conditions: Recipe['conditions'],
@@ -258,88 +254,10 @@ export class MemoryRecipeRegistry implements RecipeRegistry {
     if (!conditions || conditions.length === 0) return true;
 
     return conditions.every(condition => {
-      const fieldValue = this.getNestedValue(input, condition.field);
-      return this.evaluateCondition(condition, fieldValue);
+      const fieldValue = getNestedValue(input, condition.field);
+      return evaluateCondition(condition.operator, fieldValue, condition.value);
     });
   }
-
-  /**
-   * Get a nested value from an object using dot notation.
-   */
-  private getNestedValue(obj: Record<string, unknown>, path: string): unknown {
-    return path.split('.').reduce<unknown>((current, key) => {
-      if (current && typeof current === 'object' && key in current) {
-        return (current as Record<string, unknown>)[key];
-      }
-      return undefined;
-    }, obj);
-  }
-
-  /**
-   * Evaluate a single condition.
-   */
-  private evaluateCondition(
-    condition: RecipeCondition,
-    fieldValue: unknown
-  ): boolean {
-    const { operator, value } = condition;
-
-    switch (operator) {
-      case 'eq':
-        return fieldValue === value;
-
-      case 'neq':
-        return fieldValue !== value;
-
-      case 'gt':
-        return typeof fieldValue === 'number' && typeof value === 'number'
-          ? fieldValue > value
-          : false;
-
-      case 'gte':
-        return typeof fieldValue === 'number' && typeof value === 'number'
-          ? fieldValue >= value
-          : false;
-
-      case 'lt':
-        return typeof fieldValue === 'number' && typeof value === 'number'
-          ? fieldValue < value
-          : false;
-
-      case 'lte':
-        return typeof fieldValue === 'number' && typeof value === 'number'
-          ? fieldValue <= value
-          : false;
-
-      case 'contains':
-        if (typeof fieldValue === 'string' && typeof value === 'string') {
-          return fieldValue.includes(value);
-        }
-        if (Array.isArray(fieldValue)) {
-          return fieldValue.includes(value);
-        }
-        return false;
-
-      case 'matches':
-        if (typeof fieldValue === 'string' && typeof value === 'string') {
-          try {
-            return new RE2(value).test(fieldValue);
-          } catch {
-            return false;
-          }
-        }
-        return false;
-
-      case 'exists':
-        return fieldValue !== undefined && fieldValue !== null && fieldValue !== '';
-
-      case 'notExists':
-        return fieldValue === undefined || fieldValue === null || fieldValue === '';
-
-      default:
-        return false;
-    }
-  }
 }
 
 // ============================================================================

package/src/scheduler/cron.test.ts

@@ -223,6 +223,14 @@ describe('CronScheduler', () => {
       // Run pending timers for poll interval
       await vi.runOnlyPendingTimersAsync();
 
+      // Stop the scheduler and shut down the engine while fake timers are
+      // still active so that any setImmediate/setTimeout handles created
+      // under fake timers are cleared with the fake clear* functions.
+      // Clearing fake-timer handles with real clearImmediate corrupts
+      // Node 20/22's internal timer state and breaks subsequent tests.
+      await scheduler.stop();
+      await engine.shutdown();
+
       vi.useRealTimers();
 
       // Note: With fake timers, the actual workflow may not complete
@@ -460,7 +468,7 @@ describe('CronScheduler', () => {
       expect(loaded).toBeDefined();
       expect(loaded!.nextRunAt).toBeUndefined();
       expect(logger.error).toHaveBeenCalledWith(
-        expect.stringContaining('Failed to parse cron expression'),
+        expect.stringContaining('Invalid cron expression'),
         expect.anything()
       );
 

package/src/scheduler/cron.ts

@@ -117,6 +117,16 @@ export class CronScheduler implements Scheduler {
       return;
     }
 
+    // Clean up any leftover subscriptions from a previous start/stop cycle
+    if (this.eventUnsubscribe) {
+      this.eventUnsubscribe();
+      this.eventUnsubscribe = null;
+    }
+    if (this.pollTimer) {
+      clearInterval(this.pollTimer);
+      this.pollTimer = null;
+    }
+
     this.logger.info('Starting scheduler...');
 
     // Load schedules from persistence if available
@@ -128,10 +138,24 @@ export class CronScheduler implements Scheduler {
       this.logger.info(`Loaded ${loaded.length} schedules from persistence`);
     }
 
-    // Calculate next run times for cron schedules
+    // Calculate next run times for cron schedules.
+    // Wrap each schedule in try-catch so one invalid persisted cron expression
+    // doesn't prevent the rest from loading.
     for (const schedule of this.schedules.values()) {
       if (schedule.triggerType === 'cron' && schedule.cronExpression) {
-        this.updateNextRunTime(schedule);
+        try {
+          CronExpressionParser.parse(schedule.cronExpression, {
+            tz: schedule.timezone,
+          });
+          this.updateNextRunTime(schedule);
+        } catch (error) {
+          this.logger.error(
+            `Invalid cron expression "${schedule.cronExpression}" for schedule ${schedule.id}, disabling schedule:`,
+            error
+          );
+          schedule.enabled = false;
+          schedule.nextRunAt = undefined;
+        }
       }
     }
 

package/src/scheduler/postgres-persistence.ts

@@ -15,6 +15,8 @@ let sql: any;
 let pgModule: any;
 import type { WorkflowSchedule } from './types.js';
 import type { SchedulePersistence } from './cron.js';
+import type { Logger, RunStatus } from '../core/types.js';
+import { safeJsonParse as sharedSafeJsonParse } from '../utils/safe-json.js';
 
 // ============================================================================
 // Database Types (Kysely schema)
@@ -97,6 +99,13 @@ export interface PostgresSchedulePersistenceConfig {
    * @default true
    */
   autoMigrate?: boolean;
+
+  /**
+   * Optional structured logger used to surface JSON corruption events.
+   * Without one, parse failures still increment the corruption counter
+   * exposed via `getJsonParseCorruptionCount()` but produce no log output.
+   */
+  logger?: Logger;
 }
 
 // ============================================================================
@@ -141,6 +150,7 @@ export class PostgresSchedulePersistence implements SchedulePersistence {
   private autoMigrate: boolean;
   private initialized = false;
   private config: PostgresSchedulePersistenceConfig;
+  private logger: Logger | undefined;
 
   constructor(config: PostgresSchedulePersistenceConfig) {
     this.schema = config.schema ?? 'public';
@@ -159,6 +169,7 @@ export class PostgresSchedulePersistence implements SchedulePersistence {
     }
     this.autoMigrate = config.autoMigrate !== false;
     this.config = config;
+    this.logger = config.logger;
   }
 
   /**
@@ -483,6 +494,19 @@ export class PostgresSchedulePersistence implements SchedulePersistence {
   // Helper Methods
   // ============================================================================
 
+  private safeParseOptionalField(value: unknown, rowId: string, column: string): unknown {
+    if (!value) return undefined;
+    if (typeof value === 'string') {
+      return sharedSafeJsonParse(value, undefined, {
+        component: 'PostgresSchedulePersistence',
+        rowId,
+        column,
+        logger: this.logger,
+      });
+    }
+    return value;
+  }
+
   private rowToSchedule(row: WorkflowSchedulesTable): WorkflowSchedule {
     return {
       id: row.id,
@@ -491,21 +515,9 @@ export class PostgresSchedulePersistence implements SchedulePersistence {
       cronExpression: row.cron_expression ?? undefined,
       timezone: row.timezone ?? undefined,
       triggerOnWorkflowKind: row.trigger_on_workflow_kind ?? undefined,
-      triggerOnStatus: row.trigger_on_status
-        ? (typeof row.trigger_on_status === 'string'
-            ? JSON.parse(row.trigger_on_status)
-            : row.trigger_on_status)
-        : undefined,
-      input: row.input_json
-        ? (typeof row.input_json === 'string'
-            ? JSON.parse(row.input_json)
-            : row.input_json)
-        : undefined,
-      metadata: row.metadata_json
-        ? (typeof row.metadata_json === 'string'
-            ? JSON.parse(row.metadata_json)
-            : row.metadata_json)
-        : undefined,
+      triggerOnStatus: this.safeParseOptionalField(row.trigger_on_status, row.id, 'trigger_on_status') as RunStatus[] | undefined,
+      input: this.safeParseOptionalField(row.input_json, row.id, 'input_json') as Record<string, unknown> | undefined,
+      metadata: this.safeParseOptionalField(row.metadata_json, row.id, 'metadata_json') as Record<string, unknown> | undefined,
       enabled: row.enabled,
       lastRunAt: row.last_run_at ? new Date(row.last_run_at) : undefined,
       lastRunId: row.last_run_id ?? undefined,

package/src/scheduler/sqlite-persistence.ts

@@ -7,7 +7,9 @@
 import type { Database, Statement } from 'better-sqlite3';
 import type { WorkflowSchedule } from './types';
 import type { SchedulePersistence } from './cron';
+import type { Logger, RunStatus } from '../core/types';
 import { generateId } from '../utils/id';
+import { safeJsonParse as sharedSafeJsonParse } from '../utils/safe-json';
 
 // ============================================================================
 // Configuration Types
@@ -22,6 +24,13 @@ export interface SQLiteSchedulePersistenceConfig {
 
   /** Table name for schedules (default: workflow_schedules) */
   tableName?: string;
+
+  /**
+   * Optional structured logger used to surface JSON corruption events.
+   * Without one, parse failures still increment the corruption counter
+   * exposed via `getJsonParseCorruptionCount()` but produce no log output.
+   */
+  logger?: Logger;
 }
 
 // ============================================================================
@@ -47,6 +56,7 @@ export interface SQLiteSchedulePersistenceConfig {
 export class SQLiteSchedulePersistence implements SchedulePersistence {
   private db: Database;
   private tableName: string;
+  private logger: Logger | undefined;
   private stmts: {
     insert: Statement;
     update: Statement;
@@ -61,6 +71,7 @@ export class SQLiteSchedulePersistence implements SchedulePersistence {
     if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(this.tableName)) {
       throw new Error(`Invalid table name: ${this.tableName}`);
     }
+    this.logger = config.logger;
     this.initializeDatabase();
   }
 
@@ -217,6 +228,20 @@ export class SQLiteSchedulePersistence implements SchedulePersistence {
   // Helper Methods
   // ============================================================================
 
+  private safeJsonParse(
+    json: string,
+    fallback: unknown,
+    rowId: string,
+    column: string,
+  ): unknown {
+    return sharedSafeJsonParse(json, fallback, {
+      component: 'SQLiteSchedulePersistence',
+      rowId,
+      column,
+      logger: this.logger,
+    });
+  }
+
   private rowToSchedule(row: ScheduleRow): WorkflowSchedule {
     return {
       id: row.id,
@@ -226,10 +251,10 @@ export class SQLiteSchedulePersistence implements SchedulePersistence {
       timezone: row.timezone ?? undefined,
       triggerOnWorkflowKind: row.trigger_on_workflow_kind ?? undefined,
       triggerOnStatus: row.trigger_on_status
-        ? JSON.parse(row.trigger_on_status)
+        ? this.safeJsonParse(row.trigger_on_status, undefined, row.id, 'trigger_on_status') as RunStatus[] | undefined
         : undefined,
-      input: row.input ? JSON.parse(row.input) : undefined,
-      metadata: row.metadata ? JSON.parse(row.metadata) : undefined,
+      input: row.input ? this.safeJsonParse(row.input, undefined, row.id, 'input') as Record<string, unknown> | undefined : undefined,
+      metadata: row.metadata ? this.safeJsonParse(row.metadata, undefined, row.id, 'metadata') as Record<string, unknown> | undefined : undefined,
       enabled: row.enabled === 1,
       lastRunAt: row.last_run_at ? new Date(row.last_run_at) : undefined,
       lastRunId: row.last_run_id ?? undefined,