@trebired/git-host 2.2.0 → 3.0.0

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `@trebired/git-host` will be documented here.
 
 This project follows semantic versioning once published.
 
+## 3.0.0
+
+- **Security (breaking):** the Actions execution engine no longer spreads the embedding process's full `process.env` into workflow steps. Previously every step inherited the entire host environment, so any caller who could trigger a run could read (and echo) host process secrets, and those inherited values were not redacted from logs. Steps now run with a minimal, clean base env.
+- Added a documented default passthrough allowlist needed for tooling to work — `PATH`, `HOME`, `LANG`, `LC_ALL`, `TZ`, `TERM` (plus the platform equivalents on Windows) — with everything else opt-in.
+- Added `actions.environment` configuration: `passthrough` (additive allowlist of `process.env` keys), `baseEnv` (explicit key/value pairs), `sensitiveKeys` (key names whose resolved values are always masked), and `inheritProcessEnv` (explicit, warning-logged opt-in that reproduces the pre-3.0 full-inheritance behavior exactly).
+- Extended output redaction so all values from the secrets map plus any `environment.sensitiveKeys` are masked in `step.output`/`job.output` event chunks, step output previews, and step summaries derived from step/action errors.
+- Added off-by-default local-runner isolation hooks under `actions.localRunner`: `uid`/`gid` privilege drop (passed to `spawn` where supported), `execTimeoutMs` per-step wall-clock kill (SIGTERM → SIGKILL), and a `beforeSpawn(childSpec)` hook so callers can wrap the step shell in their own sandbox (bwrap/nsjail/container) without forking. Documented the local-runner trust boundary: it executes arbitrary code as the host user, so only trusted workflows should run on it.
+- Added `createBubblewrapSandbox()`, a batteries-included `beforeSpawn` sandbox for Linux that wraps each step in `bwrap` with an isolated filesystem view (read-only system paths plus a writable job workspace), no network by default, and fresh pid/ipc/uts/user namespaces — configurable via `allowNetwork`, `roBind`, `bind`, `systemPaths`, and `bwrapPath`.
+- Added a startup warning when the local runner would execute steps as root with no `localRunner.uid` drop and no `beforeSpawn` sandbox (workflow code would run as root on the host).
+- Corrected the published package `license` metadata to `AGPL-3.0-only` to match the bundled `LICENSE`.
+
+  **Migration:** if a workflow relied on an inherited host env variable, add it to `actions.environment.passthrough` (or `actions.environment.baseEnv`), or set `actions.environment.inheritProcessEnv: true` to restore the previous behavior.
+
 ## 2.2.0
 
 - Added a GitHub-Actions-inspired workflow schema (`gha-subset-v1`) alongside the existing flat shell-step format: `on.workflow_dispatch.inputs`, `on.push.branches`/`tags`, top-level `env`/`permissions`/`concurrency`, and multiple `jobs` with `runs-on`, `needs`, `if`, `env`, and `strategy.matrix`, normalized and validated against an explicit supported subset. Old flat workflow files keep running unchanged.

package/README.md

@@ -209,8 +209,8 @@ Supported subset:
 download time — the same asset shape and download path the release API already
 serves. GitHub Actions has no built-in equivalent for this (you'd reach for a
 marketplace action like `softprops/action-gh-release`); this is an intentional
-Operlorn-only addition, not an attempt to mirror GitHub syntax for something GitHub
-doesn't ship itself.
+first-party addition to git-host's Actions, not an attempt to mirror GitHub syntax
+for something GitHub doesn't ship itself.
 
 ```yaml
 - uses: actions/publish-release-asset@v1
@@ -364,20 +364,116 @@ const forge = createGitForge({
 });
 ```
 
-Runtime env merge order:
+Runtime env merge order (later layers win):
 
-- base process env
+- clean base env (see below — **not** the full host `process.env` by default)
 - static `actions.env`
 - host-provided execution env
 - workflow `env`
 - job `env`
 - step `env`
+- host-provided secrets
 
-Secrets are available to expressions and the runtime env, but their values are redacted from:
+#### Step environment isolation
+
+By default the runtime does **not** spread the embedding process's `process.env`
+into workflow steps, so host process secrets can never leak into (or be echoed
+by) a workflow. Instead it builds a minimal base env from a small passthrough
+allowlist needed for tooling to work: `PATH`, `HOME`, `LANG`, `LC_ALL`, `TZ`,
+`TERM` (plus the platform equivalents on Windows). Everything else is opt-in via
+`actions.environment`:
+
+```ts
+const forge = createGitForge({
+  actions: {
+    environment: {
+      // Additive allowlist of extra process.env keys to expose to steps.
+      passthrough: ["NODE_EXTRA_CA_CERTS"],
+      // Explicit key/value pairs injected into the clean base env.
+      baseEnv: { CI: "true" },
+      // Key names whose resolved values are always masked from logs/output.
+      sensitiveKeys: ["DEPLOY_KEY"],
+      // Escape hatch: restore the pre-2.x behavior of inheriting the ENTIRE host
+      // process env. Explicit opt-in, logged with a warning. Not redacted.
+      inheritProcessEnv: false,
+    },
+  },
+  gitHost,
+  storage,
+});
+```
+
+> **Migration note (breaking):** before this release every step inherited the
+> full host `process.env`. If a workflow relied on an inherited variable, add it
+> to `environment.passthrough` (or `environment.baseEnv`), or set
+> `environment.inheritProcessEnv: true` to reproduce the old behavior exactly.
+
+Secrets are available to expressions and the runtime env, but their values —
+along with the resolved values of any `environment.sensitiveKeys` — are redacted
+from:
 
 - live socket output
-- persisted event payloads
+- persisted event payloads (`step.output`/`job.output` chunks)
 - step output previews
+- step summaries derived from step/action errors
+
+#### Local runner trust boundary and isolation hooks
+
+The local runner executes each step as `spawn(shell, ["-lc", command])` **as the
+host user, unsandboxed by default**, with full filesystem reach; only the per-job
+git workspace is scratch. **Only run untrusted workflows behind a sandbox.** If
+the runtime detects it is running as root with no `localRunner.uid` drop and no
+`beforeSpawn` sandbox, it logs a warning at startup.
+
+For a batteries-included sandbox on Linux, pass `createBubblewrapSandbox()` as the
+`beforeSpawn` hook. It wraps each step in [bubblewrap](https://github.com/containers/bubblewrap)
+(`bwrap` must be on `PATH`) with an isolated filesystem view (read-only system
+paths plus a writable job workspace), no network, and fresh pid/ipc/uts/user
+namespaces:
+
+```ts
+import { createBubblewrapSandbox, createGitForge } from "@trebired/git-host";
+
+const forge = createGitForge({
+  actions: {
+    localRunner: {
+      beforeSpawn: createBubblewrapSandbox({
+        allowNetwork: false,          // default: no network for steps
+        roBind: ["/opt/toolchain"],   // extra read-only host paths
+        bind: [],                     // extra writable host paths
+      }),
+    },
+  },
+  gitHost,
+  storage,
+});
+```
+
+For finer control (or a different sandbox such as nsjail or a container),
+`actions.localRunner` also exposes lower-level off-by-default knobs:
+
+```ts
+const forge = createGitForge({
+  actions: {
+    localRunner: {
+      uid: 65534,              // drop privileges (passed to spawn where supported)
+      gid: 65534,
+      execTimeoutMs: 600_000,  // per-step wall-clock kill (SIGTERM -> SIGKILL)
+      // Wrap the shell in your own sandbox (bwrap/nsjail/container). Return a
+      // modified child spec, or nothing to keep the default.
+      beforeSpawn(child) {
+        return {
+          ...child,
+          command: "bwrap",
+          args: ["--unshare-all", "--", child.command, ...child.args],
+        };
+      },
+    },
+  },
+  gitHost,
+  storage,
+});
+```
 
 ### Workflow APIs
 
@@ -536,7 +632,3 @@ Repository Actions workflow binaries are built in CI for:
 - Linux arm64 GNU
 - macOS x64
 - macOS arm64
-
-## License
-
-MIT

package/dist/core/actions/environment.d.ts

@@ -0,0 +1,9 @@
+import type { GitForgeActionsEnvironmentOptions, GitForgeLocalRunnerOptions } from "../../types.js";
+declare function defaultPassthroughKeys(): string[];
+declare function buildStepBaseEnv(policy: GitForgeActionsEnvironmentOptions | undefined): Record<string, string>;
+declare function runnerNeedsPrivilegeWarning(input: {
+    localRunner: GitForgeLocalRunnerOptions | undefined;
+    uid: number | null;
+}): boolean;
+export { buildStepBaseEnv, defaultPassthroughKeys, runnerNeedsPrivilegeWarning, };
+//# sourceMappingURL=environment.d.ts.map

package/dist/core/actions/environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../../src/core/actions/environment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iCAAiC,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAwBnG,iBAAS,sBAAsB,aAE9B;AAiBD,iBAAS,gBAAgB,CAAC,MAAM,EAAE,iCAAiC,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAavG;AAID,iBAAS,2BAA2B,CAAC,KAAK,EAAE;IAC1C,WAAW,EAAE,0BAA0B,GAAG,SAAS,CAAC;IACpD,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB,WAMA;AAED,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,2BAA2B,GAC5B,CAAC"}

package/dist/core/actions/environment.js

@@ -0,0 +1,64 @@
+// Minimal set of variables that generic tooling (shells, git, common CLIs) needs
+// to function. Everything else is opt-in so host process secrets never leak into
+// workflow steps by default.
+const POSIX_PASSTHROUGH = ["PATH", "HOME", "LANG", "LC_ALL", "TZ", "TERM"];
+const WINDOWS_PASSTHROUGH = [
+    "PATH",
+    "Path",
+    "PATHEXT",
+    "SystemRoot",
+    "SystemDrive",
+    "HOMEDRIVE",
+    "HOMEPATH",
+    "USERPROFILE",
+    "TEMP",
+    "TMP",
+    "COMSPEC",
+    "LANG",
+    "LC_ALL",
+    "TZ",
+    "TERM",
+];
+function defaultPassthroughKeys() {
+    return process.platform === "win32" ? WINDOWS_PASSTHROUGH : POSIX_PASSTHROUGH;
+}
+function inheritKeys(keys) {
+    const inherited = {};
+    for (const key of keys) {
+        const value = process.env[key];
+        if (value !== undefined) {
+            inherited[key] = value;
+        }
+    }
+    return inherited;
+}
+// Builds the clean base environment for a workflow step. By default only the
+// documented passthrough allowlist (plus any caller additions and explicit
+// `baseEnv`) is exposed; `inheritProcessEnv` restores full `process.env`
+// inheritance for callers that depend on the historical behavior.
+function buildStepBaseEnv(policy) {
+    const baseEnv = { ...(policy?.baseEnv || {}) };
+    if (policy?.inheritProcessEnv) {
+        return {
+            ...process.env,
+            ...baseEnv,
+        };
+    }
+    const allow = new Set([...defaultPassthroughKeys(), ...(policy?.passthrough || [])]);
+    return {
+        ...inheritKeys(allow),
+        ...baseEnv,
+    };
+}
+// True when the local runner would execute steps as root without any privilege
+// drop or sandbox, which means workflow code runs as root on the host.
+function runnerNeedsPrivilegeWarning(input) {
+    if (input.uid !== 0)
+        return false;
+    const { localRunner } = input;
+    const dropsPrivileges = localRunner?.uid !== undefined && localRunner.uid !== 0;
+    const sandboxed = typeof localRunner?.beforeSpawn === "function";
+    return !dropsPrivileges && !sandboxed;
+}
+export { buildStepBaseEnv, defaultPassthroughKeys, runnerNeedsPrivilegeWarning, };
+//# sourceMappingURL=environment.js.map

package/dist/core/actions/environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../../src/core/actions/environment.ts"],"names":[],"mappings":"AAEA,iFAAiF;AACjF,iFAAiF;AACjF,6BAA6B;AAC7B,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3E,MAAM,mBAAmB,GAAG;IAC1B,MAAM;IACN,MAAM;IACN,SAAS;IACT,YAAY;IACZ,aAAa;IACb,WAAW;IACX,UAAU;IACV,aAAa;IACb,MAAM;IACN,KAAK;IACL,SAAS;IACT,MAAM;IACN,QAAQ;IACR,IAAI;IACJ,MAAM;CACP,CAAC;AAEF,SAAS,sBAAsB;IAC7B,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,iBAAiB,CAAC;AAChF,CAAC;AAED,SAAS,WAAW,CAAC,IAAsB;IACzC,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,2EAA2E;AAC3E,yEAAyE;AACzE,kEAAkE;AAClE,SAAS,gBAAgB,CAAC,MAAqD;IAC7E,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IAC/C,IAAI,MAAM,EAAE,iBAAiB,EAAE,CAAC;QAC9B,OAAO;YACL,GAAI,OAAO,CAAC,GAA8B;YAC1C,GAAG,OAAO;SACX,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,sBAAsB,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO;QACL,GAAG,WAAW,CAAC,KAAK,CAAC;QACrB,GAAG,OAAO;KACX,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,uEAAuE;AACvE,SAAS,2BAA2B,CAAC,KAGpC;IACC,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAC9B,MAAM,eAAe,GAAG,WAAW,EAAE,GAAG,KAAK,SAAS,IAAI,WAAW,CAAC,GAAG,KAAK,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,OAAO,WAAW,EAAE,WAAW,KAAK,UAAU,CAAC;IACjE,OAAO,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC;AACxC,CAAC;AAED,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,2BAA2B,GAC5B,CAAC"}

package/dist/core/actions/local_runner.d.ts

@@ -1,13 +1,18 @@
 import { type ChildProcess } from "node:child_process";
+import type { GitForgeLocalRunnerOptions } from "../../types.js";
 type RunShellCommandInput = {
+    beforeSpawn?: GitForgeLocalRunnerOptions["beforeSpawn"];
     command: string;
     cwd: string;
     env: NodeJS.ProcessEnv;
+    execTimeoutMs?: number;
+    gid?: number;
     heartbeatIntervalMs: number;
     onHeartbeat: () => void | Promise<void>;
     onOutput: (stream: "stderr" | "stdout", chunk: string) => void | Promise<void>;
     onSpawn?: (child: ChildProcess | null) => void;
     shell: string;
+    uid?: number;
 };
 type RunShellCommandResult = {
     exitCode: number;

package/dist/core/actions/local_runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local_runner.d.ts","sourceRoot":"","sources":["../../../src/core/actions/local_runner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAM9D,KAAK,oBAAoB,GAAG;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,KAAK,IAAI,CAAC;IAC/C,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,KAAK,qBAAqB,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AASF,iBAAe,uBAAuB,CAAC,KAAK,EAAE;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;CACvB,iBA0BA;AAED,iBAAe,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAqC1F;AA4CD,iBAAe,YAAY,CAAC,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM;;;;GAG/D;AAED,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,YAAY,GACb,CAAC"}
+{"version":3,"file":"local_runner.d.ts","sourceRoot":"","sources":["../../../src/core/actions/local_runner.ts"],"names":[],"mappings":"AAEA,OAAO,EAAS,KAAK,YAAY,EAAqB,MAAM,oBAAoB,CAAC;AAIjF,OAAO,KAAK,EAAgC,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAE9F,KAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,0BAA0B,CAAC,aAAa,CAAC,CAAC;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,KAAK,IAAI,CAAC;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,KAAK,qBAAqB,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAgEF,iBAAe,uBAAuB,CAAC,KAAK,EAAE;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;CACvB,iBA0BA;AASD,iBAAe,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA4B1F;AA4CD,iBAAe,YAAY,CAAC,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM;;;;GAG/D;AAED,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,YAAY,GACb,CAAC"}

package/dist/core/actions/local_runner.js

@@ -4,10 +4,62 @@ import { spawn } from "node:child_process";
 import { GitHostError } from "../../errors.js";
 import { runGit } from "../run_git.js";
 const OUTPUT_PREVIEW_LIMIT = 4000;
+// Grace period between the SIGTERM and the follow-up SIGKILL for timed-out steps.
+const TIMEOUT_SIGKILL_GRACE_MS = 5000;
 function appendPreview(current, chunk) {
     const next = `${current}${chunk}`;
     return next.length <= OUTPUT_PREVIEW_LIMIT ? next : next.slice(-OUTPUT_PREVIEW_LIMIT);
 }
+// Builds the concrete process to spawn for a step and lets callers wrap it (for
+// example with a sandbox such as bwrap/nsjail) via the `beforeSpawn` hook.
+async function resolveChildSpec(input) {
+    const base = {
+        args: ["-lc", input.command],
+        command: input.shell,
+        cwd: input.cwd,
+        env: input.env,
+        ...(input.gid === undefined ? {} : { gid: input.gid }),
+        ...(input.uid === undefined ? {} : { uid: input.uid }),
+    };
+    const next = input.beforeSpawn ? await input.beforeSpawn(base) : undefined;
+    return next || base;
+}
+function spawnChildSpec(spec) {
+    const options = {
+        cwd: spec.cwd,
+        env: spec.env,
+        stdio: ["ignore", "pipe", "pipe"],
+        ...(spec.gid === undefined ? {} : { gid: spec.gid }),
+        ...(spec.uid === undefined ? {} : { uid: spec.uid }),
+    };
+    return spawn(spec.command, spec.args, options);
+}
+// Escalates a per-step wall-clock timeout from SIGTERM to SIGKILL. Returns a
+// disposer that cancels the pending signals once the child settles.
+function attachExecTimeout(child, execTimeoutMs) {
+    if (!execTimeoutMs || execTimeoutMs <= 0)
+        return () => { };
+    const term = setTimeout(() => child.kill("SIGTERM"), execTimeoutMs);
+    const kill = setTimeout(() => child.kill("SIGKILL"), execTimeoutMs + TIMEOUT_SIGKILL_GRACE_MS);
+    term.unref?.();
+    kill.unref?.();
+    return () => {
+        clearTimeout(term);
+        clearTimeout(kill);
+    };
+}
+function wireChildOutput(child, input, preview) {
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => {
+        preview.value = appendPreview(preview.value, chunk);
+        void input.onOutput("stdout", chunk);
+    });
+    child.stderr?.setEncoding("utf8");
+    child.stderr?.on("data", (chunk) => {
+        preview.value = appendPreview(preview.value, chunk);
+        void input.onOutput("stderr", chunk);
+    });
+}
 async function materializeJobWorkspace(input) {
     fs.rmSync(input.workspacePath, { force: true, recursive: true });
     fs.mkdirSync(path.dirname(input.workspacePath), { recursive: true });
@@ -35,42 +87,42 @@ async function materializeJobWorkspace(input) {
         });
     }
 }
+function resolveExitCode(code, signal) {
+    if (typeof code === "number")
+        return code;
+    if (signal === "SIGKILL")
+        return 137;
+    if (signal === "SIGTERM" || signal === "SIGINT")
+        return 130;
+    return 1;
+}
 async function runShellCommand(input) {
-    let outputPreview = "";
+    const preview = { value: "" };
+    const spec = await resolveChildSpec(input);
     const exitCode = await new Promise((resolve, reject) => {
-        const child = spawn(input.shell, ["-lc", input.command], {
-            cwd: input.cwd,
-            env: input.env,
-            stdio: ["ignore", "pipe", "pipe"],
-        });
+        const child = spawnChildSpec(spec);
         input.onSpawn?.(child);
         const heartbeat = setInterval(() => {
             void input.onHeartbeat();
         }, Math.max(250, input.heartbeatIntervalMs));
-        child.stdout?.setEncoding("utf8");
-        child.stdout?.on("data", (chunk) => {
-            outputPreview = appendPreview(outputPreview, chunk);
-            void input.onOutput("stdout", chunk);
-        });
-        child.stderr?.setEncoding("utf8");
-        child.stderr?.on("data", (chunk) => {
-            outputPreview = appendPreview(outputPreview, chunk);
-            void input.onOutput("stderr", chunk);
-        });
+        const disposeTimeout = attachExecTimeout(child, input.execTimeoutMs);
+        wireChildOutput(child, input, preview);
         child.on("error", (error) => {
             clearInterval(heartbeat);
+            disposeTimeout();
             input.onSpawn?.(null);
             reject(error);
         });
         child.on("close", (code, signal) => {
             clearInterval(heartbeat);
+            disposeTimeout();
             input.onSpawn?.(null);
-            resolve(typeof code === "number" ? code : (signal === "SIGTERM" || signal === "SIGINT" ? 130 : 1));
+            resolve(resolveExitCode(code, signal));
         });
     });
     return {
         exitCode,
-        outputPreview,
+        outputPreview: preview.value,
     };
 }
 async function assertBinaryAvailable(command, cwd) {

package/dist/core/actions/local_runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"local_runner.js","sourceRoot":"","sources":["../../../src/core/actions/local_runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAE9D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAmBvC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,SAAS,aAAa,CAAC,OAAe,EAAE,KAAa;IACnD,MAAM,IAAI,GAAG,GAAG,OAAO,GAAG,KAAK,EAAE,CAAC;IAClC,OAAO,IAAI,CAAC,MAAM,IAAI,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,CAAC;AACxF,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,KAItC;IACC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE;QAC3G,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;KACvC,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,YAAY,CAAC,6BAA6B,EAAE,uDAAuD,EAAE;YAC7G,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE;QACxE,GAAG,EAAE,KAAK,CAAC,aAAa;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CAAC,6BAA6B,EAAE,2CAA2C,EAAE;YACjG,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAA2B;IACxD,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;YACvD,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YACjC,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC7C,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,aAAa,GAAG,aAAa,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;YACpD,KAAK,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,aAAa,GAAG,aAAa,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;YACpD,KAAK,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;YACtB,OAAO,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrG,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO;QACL,QAAQ;QACR,aAAa;KACd,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,OAAe,EAAE,GAAW;IAC/D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACjD,KAAK,GAAG,CAAC;IACT,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,cAAc,OAAO,EAAE,CAAC,EAAE;QAC5D,GAAG;QACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QACjD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CAAC,6BAA6B,EAAE,qBAAqB,OAAO,yCAAyC,EAAE;YAC3H,OAAO;SACR,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,GAAW;IAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE;QAC5C,GAAG;QACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACzC,MAAM,IAAI,KAAK,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACzC,MAAM,IAAI,KAAK,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IACH,OAAO;QACL,QAAQ;QACR,MAAM;QACN,MAAM;KACP,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAuB,EAAE,GAAW;IAC9D,MAAM,qBAAqB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1C,OAAO,MAAM,iBAAiB,CAAC,GAAG,OAAO,YAAY,EAAE,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,YAAY,GACb,CAAC"}
+{"version":3,"file":"local_runner.js","sourceRoot":"","sources":["../../../src/core/actions/local_runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAwC,MAAM,oBAAoB,CAAC;AAEjF,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAuBvC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAClC,kFAAkF;AAClF,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAEtC,SAAS,aAAa,CAAC,OAAe,EAAE,KAAa;IACnD,MAAM,IAAI,GAAG,GAAG,OAAO,GAAG,KAAK,EAAE,CAAC;IAClC,OAAO,IAAI,CAAC,MAAM,IAAI,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAAC,CAAC;AACxF,CAAC;AAED,gFAAgF;AAChF,2EAA2E;AAC3E,KAAK,UAAU,gBAAgB,CAAC,KAA2B;IACzD,MAAM,IAAI,GAAiC;QACzC,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;QAC5B,OAAO,EAAE,KAAK,CAAC,KAAK;QACpB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,GAA6B;QACxC,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QACtD,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;KACvD,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,OAAO,IAAI,IAAI,IAAI,CAAC;AACtB,CAAC;AAED,SAAS,cAAc,CAAC,IAAkC;IACxD,MAAM,OAAO,GAAiB;QAC5B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QACpD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;KACrD,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,6EAA6E;AAC7E,oEAAoE;AACpE,SAAS,iBAAiB,CAAC,KAAmB,EAAE,aAAiC;IAC/E,IAAI,CAAC,aAAa,IAAI,aAAa,IAAI,CAAC;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,GAAG,wBAAwB,CAAC,CAAC;IAC/F,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;IACf,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;IACf,OAAO,GAAG,EAAE;QACV,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,YAAY,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAmB,EAAE,KAA2B,EAAE,OAA0B;IACnG,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACzC,OAAO,CAAC,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,KAAK,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACzC,OAAO,CAAC,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,KAAK,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,KAItC;IACC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE;QAC3G,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;KACvC,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,YAAY,CAAC,6BAA6B,EAAE,uDAAuD,EAAE;YAC7G,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE;QACxE,GAAG,EAAE,KAAK,CAAC,aAAa;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,YAAY,CAAC,6BAA6B,EAAE,2CAA2C,EAAE;YACjG,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,aAAa,EAAE,KAAK,CAAC,aAAa;SACnC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAmB,EAAE,MAA6B;IACzE,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAC5D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAA2B;IACxD,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7D,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACnC,KAAK,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YACjC,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC7C,MAAM,cAAc,GAAG,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QACrE,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACvC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,cAAc,EAAE,CAAC;YACjB,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,cAAc,EAAE,CAAC;YACjB,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;YACtB,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO;QACL,QAAQ;QACR,aAAa,EAAE,OAAO,CAAC,KAAK;KAC7B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,OAAe,EAAE,GAAW;IAC/D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACjD,KAAK,GAAG,CAAC;IACT,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,cAAc,OAAO,EAAE,CAAC,EAAE;QAC5D,GAAG;QACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QACjD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,YAAY,CAAC,6BAA6B,EAAE,qBAAqB,OAAO,yCAAyC,EAAE;YAC3H,OAAO;SACR,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,GAAW;IAC3D,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE;QAC5C,GAAG;QACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACzC,MAAM,IAAI,KAAK,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACzC,MAAM,IAAI,KAAK,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IACH,OAAO;QACL,QAAQ;QACR,MAAM;QACN,MAAM;KACP,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAuB,EAAE,GAAW;IAC9D,MAAM,qBAAqB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1C,OAAO,MAAM,iBAAiB,CAAC,GAAG,OAAO,YAAY,EAAE,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,YAAY,GACb,CAAC"}

package/dist/core/actions/node_runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node_runner.d.ts","sourceRoot":"","sources":["../../../src/core/actions/node_runner.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,sBAAsB,EAEtB,yBAAyB,EAE1B,MAAM,YAAY,CAAC;AA6LpB,iBAAS,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,GAAG,sBAAsB,CAgDnF;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAC"}
+{"version":3,"file":"node_runner.d.ts","sourceRoot":"","sources":["../../../src/core/actions/node_runner.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,sBAAsB,EAEtB,yBAAyB,EAE1B,MAAM,YAAY,CAAC;AA6LpB,iBAAS,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,GAAG,sBAAsB,CAgDnF;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/core/actions/node_runner.js

@@ -1,5 +1,6 @@
 import { spawn } from "node:child_process";
 import { text } from "../../utils/text.js";
+import { buildStepBaseEnv } from "./environment.js";
 import { appendPreview, normalizeRunnerInput } from "./runner/protocol.js";
 import { materializeWorkspace } from "./workspace.js";
 function createRunnerState() {
@@ -10,7 +11,7 @@ function createRunnerState() {
 }
 function buildStepEnv(input, step) {
     return {
-        ...process.env,
+        ...buildStepBaseEnv(input.actions?.environment),
         ...(input.actions?.env || {}),
         ...(step.env || {}),
     };

package/dist/core/actions/node_runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"node_runner.js","sourceRoot":"","sources":["../../../src/core/actions/node_runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAE9D,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAO3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,SAAS,iBAAiB;IACxB,OAAO;QACL,aAAa,EAAE,CAAC,CAAC;QACjB,YAAY,EAAE,EAAE;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,KAAgC,EAChC,IAA8D;IAE9D,OAAO;QACL,GAAG,OAAO,CAAC,GAAG;QACd,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAgC,EAAE,IAA8D;IACxH,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC;AACxE,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAmC;IAI7D,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,OAAO;QACL,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS;QAC1B,MAAM,EAAE;YACN,IAAI,MAAM;gBACR,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,MAAgC;gBACnC,MAAM,GAAG,IAAI,CAAC;gBACd,SAAS,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACzG,IAAI,CAAC;oBACH,OAAO,QAAQ,EAAE,EAAE,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;gBACnF,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;gBACV,OAAO,KAAK,CAAC;YACf,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAgC,EAChC,IAA8D;IAE9D,OAAO,KAAK,CAAC,OAAO,CAAC;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,KAAK;QACtB,SAAS,EAAE,IAAI,CAAC,IAAI;QACpB,IAAI,EAAE,cAAc;KACrB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAgC,EAChC,IAA8D,EAC9D,MAA2B,EAC3B,KAAa;IAEb,OAAO,KAAK,CAAC,OAAO,CAAC;QACnB,KAAK;QACL,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,KAAK;QACtB,SAAS,EAAE,IAAI,CAAC,IAAI;QACpB,MAAM;QACN,IAAI,EAAE,aAAa;KACpB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAgC,EAChC,mBAA2B,EAC3B,IAA8D;IAE9D,OAAO,WAAW,CAAC,GAAG,EAAE;QACtB,KAAK,KAAK,CAAC,OAAO,CAAC;YACjB,OAAO,EAAE,IAAI,CAAC,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,KAAK;YACtB,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;IACL,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAmB,EAAE,MAA6B,EAAE,WAA0B;IAC7G,OAAO,OAAO,IAAI,KAAK,QAAQ;QAC7B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAgC,EAChC,IAA8D,EAC9D,QAAgB,EAChB,aAAqB,EACrB,WAA0B;IAE1B,MAAM,SAAS,GAAG,WAAW,EAAE,CAAC;IAChC,MAAM,KAAK,CAAC,OAAO,CAAC;QAClB,SAAS,EAAE,QAAQ;QACnB,cAAc,EAAE,aAAa;QAC7B,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzE,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,KAAK;QACtB,SAAS,EAAE,IAAI,CAAC,IAAI;QACpB,OAAO,EAAE,SAAS;YAChB,CAAC,CAAC,yBAAyB,IAAI,CAAC,IAAI,GAAG;YACvC,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,IAAI,GAAG,CAAC;QACnF,IAAI,EAAE,eAAe;KACtB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CACpB,KAAgC,EAChC,mBAA2B,EAC3B,kBAA0B,EAC1B,QAA8C,EAC9C,WAA0B,EAC1B,IAA8D;IAE9D,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,IAAI,aAAa,GAAG,EAAE,CAAC;IAEvB,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACvD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAChD,GAAG,EAAE,kBAAkB;YACvB,GAAG;YACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAC;QAE5E,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,aAAa,GAAG,aAAa,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;YACpD,KAAK,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,aAAa,GAAG,aAAa,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;YACpD,KAAK,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,CAAC;YACf,OAAO,CAAC,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,iBAAiB,EAAE,GAAG,EAAE,CAAC,aAAa;KACvC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,KAAgC,EAChC,mBAA2B,EAC3B,kBAA0B,EAC1B,KAAsB,EACtB,QAA8C,EAC9C,WAA0B,EAC1B,IAA8D;IAE9D,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC;IACjC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC;IAE/B,MAAM,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IAC3G,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;IACxC,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,iBAAiB,EAAE,EAAE,WAAW,CAAC,CAAC;IAC5F,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAgC;IACzD,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,IAAI,YAAY,GAAwB,IAAI,CAAC;IAC7C,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;IAElF,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,kBAAkB,GAAG,MAAM,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACnE,MAAM,KAAK,CAAC,OAAO,CAAC;YAClB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,yBAAyB;YAClC,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;QAEH,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAChC,KAAK,EACL,WAAW,CAAC,qBAAqB,EACjC,kBAAkB,EAClB,KAAK,EACL,CAAC,KAAK,EAAE,EAAE;gBACR,YAAY,GAAG,KAAK,CAAC;YACvB,CAAC,EACD,WAAW,EACX,IAAI,CACL,CAAC;YACF,IAAI,WAAW,EAAE,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACL,SAAS,EAAE,WAAW,EAAE;oBACxB,QAAQ;oBACR,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,CAAC;YACX,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC;IACJ,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO;QACL,KAAK,EAAE,MAAM;QACb,SAAS;KACV,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAC"}
+{"version":3,"file":"node_runner.js","sourceRoot":"","sources":["../../../src/core/actions/node_runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAE9D,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAO3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,SAAS,iBAAiB;IACxB,OAAO;QACL,aAAa,EAAE,CAAC,CAAC;QACjB,YAAY,EAAE,EAAE;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,KAAgC,EAChC,IAA8D;IAE9D,OAAO;QACL,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC;QAC/C,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAgC,EAAE,IAA8D;IACxH,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC;AACxE,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAmC;IAI7D,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,OAAO;QACL,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS;QAC1B,MAAM,EAAE;YACN,IAAI,MAAM;gBACR,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,MAAgC;gBACnC,MAAM,GAAG,IAAI,CAAC;gBACd,SAAS,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACzG,IAAI,CAAC;oBACH,OAAO,QAAQ,EAAE,EAAE,IAAI,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;gBACnF,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;gBACV,OAAO,KAAK,CAAC;YACf,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAgC,EAChC,IAA8D;IAE9D,OAAO,KAAK,CAAC,OAAO,CAAC;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,KAAK;QACtB,SAAS,EAAE,IAAI,CAAC,IAAI;QACpB,IAAI,EAAE,cAAc;KACrB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CACzB,KAAgC,EAChC,IAA8D,EAC9D,MAA2B,EAC3B,KAAa;IAEb,OAAO,KAAK,CAAC,OAAO,CAAC;QACnB,KAAK;QACL,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,KAAK;QACtB,SAAS,EAAE,IAAI,CAAC,IAAI;QACpB,MAAM;QACN,IAAI,EAAE,aAAa;KACpB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAgC,EAChC,mBAA2B,EAC3B,IAA8D;IAE9D,OAAO,WAAW,CAAC,GAAG,EAAE;QACtB,KAAK,KAAK,CAAC,OAAO,CAAC;YACjB,OAAO,EAAE,IAAI,CAAC,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,KAAK;YACtB,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,IAAI,EAAE,gBAAgB;SACvB,CAAC,CAAC;IACL,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAmB,EAAE,MAA6B,EAAE,WAA0B;IAC7G,OAAO,OAAO,IAAI,KAAK,QAAQ;QAC7B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,KAAgC,EAChC,IAA8D,EAC9D,QAAgB,EAChB,aAAqB,EACrB,WAA0B;IAE1B,MAAM,SAAS,GAAG,WAAW,EAAE,CAAC;IAChC,MAAM,KAAK,CAAC,OAAO,CAAC;QAClB,SAAS,EAAE,QAAQ;QACnB,cAAc,EAAE,aAAa;QAC7B,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzE,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,KAAK;QACtB,SAAS,EAAE,IAAI,CAAC,IAAI;QACpB,OAAO,EAAE,SAAS;YAChB,CAAC,CAAC,yBAAyB,IAAI,CAAC,IAAI,GAAG;YACvC,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,eAAe,IAAI,CAAC,IAAI,GAAG,CAAC;QACnF,IAAI,EAAE,eAAe;KACtB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CACpB,KAAgC,EAChC,mBAA2B,EAC3B,kBAA0B,EAC1B,QAA8C,EAC9C,WAA0B,EAC1B,IAA8D;IAE9D,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,IAAI,aAAa,GAAG,EAAE,CAAC;IAEvB,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACvD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;YAChD,GAAG,EAAE,kBAAkB;YACvB,GAAG;YACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAC;QAE5E,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,aAAa,GAAG,aAAa,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;YACpD,KAAK,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,aAAa,GAAG,aAAa,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;YACpD,KAAK,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,CAAC;YACf,OAAO,CAAC,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,iBAAiB,EAAE,GAAG,EAAE,CAAC,aAAa;KACvC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,KAAgC,EAChC,mBAA2B,EAC3B,kBAA0B,EAC1B,KAAsB,EACtB,QAA8C,EAC9C,WAA0B,EAC1B,IAA8D;IAE9D,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC;IACjC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC;IAE/B,MAAM,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IAC3G,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;IACxC,MAAM,oBAAoB,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,iBAAiB,EAAE,EAAE,WAAW,CAAC,CAAC;IAC5F,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAgC;IACzD,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAClC,IAAI,YAAY,GAAwB,IAAI,CAAC;IAC7C,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,kBAAkB,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;IAElF,MAAM,SAAS,GAAG,CAAC,KAAK,IAAI,EAAE;QAC5B,MAAM,kBAAkB,GAAG,MAAM,oBAAoB,CAAC,WAAW,CAAC,CAAC;QACnE,MAAM,KAAK,CAAC,OAAO,CAAC;YAClB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,yBAAyB;YAClC,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;QAEH,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;YACrC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAChC,KAAK,EACL,WAAW,CAAC,qBAAqB,EACjC,kBAAkB,EAClB,KAAK,EACL,CAAC,KAAK,EAAE,EAAE;gBACR,YAAY,GAAG,KAAK,CAAC;YACvB,CAAC,EACD,WAAW,EACX,IAAI,CACL,CAAC;YACF,IAAI,WAAW,EAAE,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACpC,OAAO;oBACL,SAAS,EAAE,WAAW,EAAE;oBACxB,QAAQ;oBACR,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,CAAC;YACX,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,YAAY,EAAE,KAAK,CAAC,YAAY;SACjC,CAAC;IACJ,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO;QACL,KAAK,EAAE,MAAM;QACb,SAAS;KACV,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/core/actions/redaction.d.ts

@@ -1,5 +1,16 @@
 import type { CreateGitForgeActionsOptions, GitForgeWorkflowRun, GitForgeWorkflowRunStep } from "../../types.js";
+declare function collectSensitiveValues(input: {
+    env?: Record<string, string>;
+    secrets?: Record<string, string>;
+    sensitiveKeys?: string[];
+}): string[];
 declare function redactSecrets(input: string, secrets: string[]): string;
-declare function createRunRedactor(actions: CreateGitForgeActionsOptions | undefined, run: GitForgeWorkflowRun, step: GitForgeWorkflowRunStep, secrets: Record<string, string> | undefined): (chunk: string, stream?: "stderr" | "stdout") => Promise<string>;
-export { createRunRedactor, redactSecrets, };
+declare function createRunRedactor(input: {
+    actions: CreateGitForgeActionsOptions | undefined;
+    env?: Record<string, string>;
+    run: GitForgeWorkflowRun;
+    secrets: Record<string, string> | undefined;
+    step: GitForgeWorkflowRunStep;
+}): (chunk: string, stream?: "stderr" | "stdout") => Promise<string>;
+export { collectSensitiveValues, createRunRedactor, redactSecrets, };
 //# sourceMappingURL=redaction.d.ts.map

package/dist/core/actions/redaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../../src/core/actions/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAOhH,iBAAS,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAMtD;AAED,iBAAS,iBAAiB,CACxB,OAAO,EAAE,4BAA4B,GAAG,SAAS,EACjD,GAAG,EAAE,mBAAmB,EACxB,IAAI,EAAE,uBAAuB,EAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,IAGV,OAAO,MAAM,EAAE,SAAQ,QAAQ,GAAG,QAAmB,qBAYvF;AAED,OAAO,EACL,iBAAiB,EACjB,aAAa,GACd,CAAC"}
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../../src/core/actions/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAUhH,iBAAS,sBAAsB,CAAC,KAAK,EAAE;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B,YAMA;AAED,iBAAS,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAMtD;AAED,iBAAS,iBAAiB,CAAC,KAAK,EAAE;IAChC,OAAO,EAAE,4BAA4B,GAAG,SAAS,CAAC;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,EAAE,mBAAmB,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5C,IAAI,EAAE,uBAAuB,CAAC;CAC/B,IAOkC,OAAO,MAAM,EAAE,SAAQ,QAAQ,GAAG,QAAmB,qBAYvF;AAED,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,GACd,CAAC"}

package/dist/core/actions/redaction.js

@@ -1,7 +1,17 @@
-function sanitizeSecretValues(secrets) {
-    return Array.from(new Set(Object.values(secrets || {}).filter(Boolean)))
+function sanitizeSecretValues(values) {
+    return Array.from(new Set([...values].filter((value) => Boolean(value))))
         .sort((left, right) => right.length - left.length);
 }
+// Gathers every value that must be masked from streamed and persisted output:
+// all values in the secrets map plus, for any caller-declared sensitive key, the
+// resolved value from secrets and from the step environment.
+function collectSensitiveValues(input) {
+    const values = [...Object.values(input.secrets || {})];
+    for (const key of input.sensitiveKeys || []) {
+        values.push(input.secrets?.[key], input.env?.[key]);
+    }
+    return sanitizeSecretValues(values);
+}
 function redactSecrets(input, secrets) {
     let next = input;
     for (const secret of secrets) {
@@ -9,8 +19,13 @@ function redactSecrets(input, secrets) {
     }
     return next;
 }
-function createRunRedactor(actions, run, step, secrets) {
-    const secretValues = sanitizeSecretValues(secrets);
+function createRunRedactor(input) {
+    const { actions, run, step } = input;
+    const secretValues = collectSensitiveValues({
+        env: input.env,
+        secrets: input.secrets,
+        sensitiveKeys: actions?.environment?.sensitiveKeys,
+    });
     return async function redactText(chunk, stream = "stdout") {
         let next = redactSecrets(String(chunk || ""), secretValues);
         if (actions?.redactOutput) {
@@ -24,5 +39,5 @@ function createRunRedactor(actions, run, step, secrets) {
         return next;
     };
 }
-export { createRunRedactor, redactSecrets, };
+export { collectSensitiveValues, createRunRedactor, redactSecrets, };
 //# sourceMappingURL=redaction.js.map

package/dist/core/actions/redaction.js.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../../src/core/actions/redaction.ts"],"names":[],"mappings":"AAEA,SAAS,oBAAoB,CAAC,OAA2C;IACvE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;SACrE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,OAAiB;IACrD,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAiD,EACjD,GAAwB,EACxB,IAA6B,EAC7B,OAA2C;IAE3C,MAAM,YAAY,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACnD,OAAO,KAAK,UAAU,UAAU,CAAC,KAAa,EAAE,SAA8B,QAAQ;QACpF,IAAI,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;YAC1B,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;gBAChC,KAAK,EAAE,IAAI;gBACX,GAAG;gBACH,IAAI;gBACJ,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,OAAO,EACL,iBAAiB,EACjB,aAAa,GACd,CAAC"}
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../../src/core/actions/redaction.ts"],"names":[],"mappings":"AAEA,SAAS,oBAAoB,CAAC,MAAoC;IAChE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACvF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,8EAA8E;AAC9E,iFAAiF;AACjF,6DAA6D;AAC7D,SAAS,sBAAsB,CAAC,KAI/B;IACC,MAAM,MAAM,GAA8B,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IAClF,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,OAAiB;IACrD,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,KAM1B;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,YAAY,GAAG,sBAAsB,CAAC;QAC1C,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa;KACnD,CAAC,CAAC;IACH,OAAO,KAAK,UAAU,UAAU,CAAC,KAAa,EAAE,SAA8B,QAAQ;QACpF,IAAI,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;YAC1B,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;gBAChC,KAAK,EAAE,IAAI;gBACX,GAAG;gBACH,IAAI;gBACJ,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,GACd,CAAC"}

package/dist/core/actions/sandbox.d.ts

@@ -0,0 +1,4 @@
+import type { GitForgeBubblewrapSandboxOptions, GitForgeLocalRunnerChildSpec } from "../../types.js";
+declare function createBubblewrapSandbox(options?: GitForgeBubblewrapSandboxOptions): (child: GitForgeLocalRunnerChildSpec) => GitForgeLocalRunnerChildSpec;
+export { createBubblewrapSandbox, };
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/core/actions/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/core/actions/sandbox.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gCAAgC,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAuCpG,iBAAS,uBAAuB,CAAC,OAAO,GAAE,gCAAqC,IAEjD,OAAO,4BAA4B,KAAG,4BAA4B,CAO/F;AAED,OAAO,EACL,uBAAuB,GACxB,CAAC"}