@nocobase/plugin-workflow-javascript 2.1.0-beta.42 → 2.1.0-beta.43

package/dist/externalVersion.js

@@ -13,11 +13,11 @@ module.exports = {
   "antd-style": "3.7.1",
   "@formily/antd-v5": "1.2.3",
   "@ant-design/icons": "5.6.1",
-  "@nocobase/client": "2.1.0-beta.42",
-  "@nocobase/plugin-workflow": "2.1.0-beta.42",
+  "@nocobase/client": "2.1.0-beta.43",
+  "@nocobase/plugin-workflow": "2.1.0-beta.43",
   "antd": "5.24.2",
-  "@nocobase/flow-engine": "2.1.0-beta.42",
+  "@nocobase/flow-engine": "2.1.0-beta.43",
   "react-i18next": "11.18.6",
   "winston": "3.13.0",
-  "@nocobase/server": "2.1.0-beta.42"
+  "@nocobase/server": "2.1.0-beta.43"
 };

package/dist/node_modules/joi/package.json

@@ -1 +1 @@
-{"name":"joi","description":"Object schema validation","version":"17.13.3","repository":"git://github.com/hapijs/joi","main":"lib/index.js","types":"lib/index.d.ts","browser":"dist/joi-browser.min.js","files":["lib/**/*","dist/*"],"keywords":["schema","validation"],"dependencies":{"@hapi/hoek":"^9.3.0","@hapi/topo":"^5.1.0","@sideway/address":"^4.1.5","@sideway/formula":"^3.0.1","@sideway/pinpoint":"^2.0.0"},"devDependencies":{"@hapi/bourne":"2.x.x","@hapi/code":"8.x.x","@hapi/joi-legacy-test":"npm:@hapi/joi@15.x.x","@hapi/lab":"^25.1.3","@types/node":"^14.18.63","typescript":"4.3.x"},"scripts":{"prepublishOnly":"cd browser && npm install && npm run build","test":"lab -t 100 -a @hapi/code -L -Y","test-cov-html":"lab -r html -o coverage.html -a @hapi/code"},"license":"BSD-3-Clause","_lastModified":"2026-06-01T01:06:24.294Z"}
+{"name":"joi","description":"Object schema validation","version":"17.13.3","repository":"git://github.com/hapijs/joi","main":"lib/index.js","types":"lib/index.d.ts","browser":"dist/joi-browser.min.js","files":["lib/**/*","dist/*"],"keywords":["schema","validation"],"dependencies":{"@hapi/hoek":"^9.3.0","@hapi/topo":"^5.1.0","@sideway/address":"^4.1.5","@sideway/formula":"^3.0.1","@sideway/pinpoint":"^2.0.0"},"devDependencies":{"@hapi/bourne":"2.x.x","@hapi/code":"8.x.x","@hapi/joi-legacy-test":"npm:@hapi/joi@15.x.x","@hapi/lab":"^25.1.3","@types/node":"^14.18.63","typescript":"4.3.x"},"scripts":{"prepublishOnly":"cd browser && npm install && npm run build","test":"lab -t 100 -a @hapi/code -L -Y","test-cov-html":"lab -r html -o coverage.html -a @hapi/code"},"license":"BSD-3-Clause","_lastModified":"2026-06-02T14:17:32.646Z"}

package/dist/node_modules/winston-transport/package.json

@@ -1 +1 @@
-{"name":"winston-transport","description":"Base stream implementations for winston@3 and up.","version":"4.7.0","main":"index.js","browser":"dist/index.js","scripts":{"lint":"eslint test/*.js index.js --resolve-plugins-relative-to ./node_modules/@dabh/eslint-config-populist","pretest":"npm run lint && npm run build","test":"nyc mocha test/*.test.js","report":"nyc report --reporter=lcov","build":"rimraf dist && babel *.js -d ./dist","prepublishOnly":"npm run build"},"repository":{"type":"git","url":"git@github.com:winstonjs/winston-transport.git"},"keywords":["winston","transport","winston3"],"author":"Charlie Robbins <charlie.robbins@gmail.com>","license":"MIT","bugs":{"url":"https://github.com/winstonjs/winston-transport/issues"},"homepage":"https://github.com/winstonjs/winston-transport#readme","dependencies":{"logform":"^2.3.2","readable-stream":"^3.6.0","triple-beam":"^1.3.0"},"devDependencies":{"@types/node":"^20.8.6","abstract-winston-transport":">=0.5.1","assume":"^2.3.0","babel-cli":"^6.26.0","babel-preset-env":"^1.7.0","deep-equal":"^2.0.5","eslint":"^8.8.0","@dabh/eslint-config-populist":"^5.0.0","mocha":"^10.0.0","nyc":"^15.1.0","rimraf":"^5.0.5","winston-compat":"^0.1.5"},"engines":{"node":">= 12.0.0"},"_lastModified":"2026-06-01T01:06:24.583Z"}
+{"name":"winston-transport","description":"Base stream implementations for winston@3 and up.","version":"4.7.0","main":"index.js","browser":"dist/index.js","scripts":{"lint":"eslint test/*.js index.js --resolve-plugins-relative-to ./node_modules/@dabh/eslint-config-populist","pretest":"npm run lint && npm run build","test":"nyc mocha test/*.test.js","report":"nyc report --reporter=lcov","build":"rimraf dist && babel *.js -d ./dist","prepublishOnly":"npm run build"},"repository":{"type":"git","url":"git@github.com:winstonjs/winston-transport.git"},"keywords":["winston","transport","winston3"],"author":"Charlie Robbins <charlie.robbins@gmail.com>","license":"MIT","bugs":{"url":"https://github.com/winstonjs/winston-transport/issues"},"homepage":"https://github.com/winstonjs/winston-transport#readme","dependencies":{"logform":"^2.3.2","readable-stream":"^3.6.0","triple-beam":"^1.3.0"},"devDependencies":{"@types/node":"^20.8.6","abstract-winston-transport":">=0.5.1","assume":"^2.3.0","babel-cli":"^6.26.0","babel-preset-env":"^1.7.0","deep-equal":"^2.0.5","eslint":"^8.8.0","@dabh/eslint-config-populist":"^5.0.0","mocha":"^10.0.0","nyc":"^15.1.0","rimraf":"^5.0.5","winston-compat":"^0.1.5"},"engines":{"node":">= 12.0.0"},"_lastModified":"2026-06-02T14:17:32.941Z"}

package/dist/server/ScriptInstruction.d.ts

@@ -9,48 +9,51 @@
 import { Logger } from 'winston';
 import Joi from 'joi';
 import { Processor, Instruction, FlowNodeModel } from '@nocobase/plugin-workflow';
+type ScriptArgument = {
+    name: string;
+    value?: unknown;
+};
 type ScriptConfig = {
     content?: string;
     timeout?: number;
     continue?: boolean;
-    arguments?: {
-        [key: string]: any;
-    }[];
+    arguments?: ScriptArgument[];
 };
+type ScriptArguments = Record<string, unknown> | unknown[];
 export default class ScriptInstruction extends Instruction {
     /**
      * Returns the worker script path based on whether WORKFLOW_SCRIPT_MODULES is configured.
-     * - WORKFLOW_SCRIPT_MODULES set: uses Node.js vm with require support (module whitelist)
+     * - WORKFLOW_SCRIPT_MODULES set: uses Node.js vm with require support (unsafe; not a security boundary)
      * - WORKFLOW_SCRIPT_MODULES unset: uses QuickJS (WASM) for maximum security (no require, no Node.js APIs)
      */
     static get workerScript(): string;
-    static run(source: any, args: any, options: {
+    static run(source: string, args: ScriptArguments, options: {
         logger: Logger;
         timeout?: number;
         signal?: AbortSignal;
     }): Promise<{
         status: -2;
-        result: any;
+        result: string;
     } | {
         status: 1;
-        result: any;
+        result: unknown;
     }>;
     configSchema: Joi.ObjectSchema<any>;
     run(node: FlowNodeModel, prevJob: any, processor: Processor, options?: {
         signal?: AbortSignal;
     }): Promise<{
-        result: any;
+        result: unknown;
         status: -2 | 1;
     }>;
     resume(node: FlowNodeModel, job: any, processor: Processor): Promise<any>;
     test(config?: ScriptConfig): Promise<{
         log: string;
         status: -2;
-        result: any;
+        result: string;
     } | {
         log: string;
         status: 1;
-        result: any;
+        result: unknown;
     }>;
 }
 export {};

package/dist/server/ScriptInstruction.js

@@ -49,12 +49,11 @@ var import_cache_logger = require("./cache-logger");
 class ScriptInstruction extends import_plugin_workflow.Instruction {
   /**
    * Returns the worker script path based on whether WORKFLOW_SCRIPT_MODULES is configured.
-   * - WORKFLOW_SCRIPT_MODULES set: uses Node.js vm with require support (module whitelist)
+   * - WORKFLOW_SCRIPT_MODULES set: uses Node.js vm with require support (unsafe; not a security boundary)
    * - WORKFLOW_SCRIPT_MODULES unset: uses QuickJS (WASM) for maximum security (no require, no Node.js APIs)
    */
   static get workerScript() {
-    var _a;
-    const hasModules = ((_a = process.env.WORKFLOW_SCRIPT_MODULES) == null ? void 0 : _a.split(",").filter(Boolean).length) > 0;
+    const hasModules = (process.env.WORKFLOW_SCRIPT_MODULES ?? "").split(",").filter(Boolean).length > 0;
     return import_node_path.default.join(__dirname, hasModules ? "Vm.js" : "QuickJs.js");
   }
   static async run(source, args, options) {
@@ -64,7 +63,7 @@ class ScriptInstruction extends import_plugin_workflow.Instruction {
       workerData: { source, args, options: timeout ? { timeout } : {} }
     });
     const abortListener = () => {
-      void worker.terminate();
+      worker.terminate();
     };
     signal == null ? void 0 : signal.addEventListener("abort", abortListener, { once: true });
     worker.on("message", (message) => {
@@ -102,7 +101,7 @@ class ScriptInstruction extends import_plugin_workflow.Instruction {
       }
       return {
         status: import_plugin_workflow.JOB_STATUS.ERROR,
-        result: e.message
+        result: e instanceof Error ? e.message : String(e)
       };
     }
     signal == null ? void 0 : signal.removeEventListener("abort", abortListener);
@@ -174,9 +173,10 @@ class ScriptInstruction extends import_plugin_workflow.Instruction {
       jobResult.status = import_plugin_workflow.JOB_STATUS.ERROR;
       jobResult.result = res.result;
     }).catch((e) => {
-      processor.logger.error(`script (#${node.id}) get result failed, the reason is ${e.message}`);
+      const message = e instanceof Error ? e.message : String(e);
+      processor.logger.error(`script (#${node.id}) get result failed, the reason is ${message}`);
       jobResult.status = import_plugin_workflow.JOB_STATUS.ERROR;
-      jobResult.result = e.message;
+      jobResult.result = message;
     }).finally(() => {
       processor.logger.debug(`script (#${node.id}) ended, resume workflow...`);
       setImmediate(async () => {
@@ -197,12 +197,15 @@ class ScriptInstruction extends import_plugin_workflow.Instruction {
   }
   async test(config = {}) {
     const { content, timeout } = config;
-    const args = (config.arguments ?? []).reduce((pre, item) => ({ ...pre, [item.name]: item.value }), {});
+    const args = (config.arguments ?? []).reduce(
+      (pre, item) => ({ ...pre, [item.name]: item.value }),
+      {}
+    );
     const transport = new import_cache_logger.CacheTransport();
     const logger = import_winston.default.createLogger({
       transports: [transport]
     });
-    const result = await this.constructor.run(content, args, { timeout, logger });
+    const result = await this.constructor.run(content ?? "", args, { timeout, logger });
     const log = transport.getLogs();
     return {
       ...result,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/plugin-workflow-javascript",
-  "version": "2.1.0-beta.42",
+  "version": "2.1.0-beta.43",
   "displayName": "Workflow: JavaScript",
   "displayName.zh-CN": "工作流：JavaScript 节点",
   "description": "Execute a piece of JavaScript in an isolated Node.js environment.",
@@ -33,5 +33,5 @@
     "Workflow"
   ],
   "license": "Apache-2.0",
-  "gitHead": "619b4d06c934bf3266ba7f388438db018217c87d"
+  "gitHead": "6d7750e2373bf2451d246de88cc1f62491685e18"
 }