@withone/cli 2.14.3 → 2.14.4

package/dist/{chunk-IM3OA7CU.js → chunk-33KUKSRH.js}

@@ -3223,7 +3223,7 @@ async function executeSubflowStep(step, context, api, permissions, allowedAction
   if (flowStack.includes(resolvedKey)) {
     throw new Error(`Circular flow detected: ${[...flowStack, resolvedKey].join(" \u2192 ")}`);
   }
-  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-SRO6YL62.js");
+  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-PUFQASEJ.js");
   const { flow: subFlow, rootDir: subRootDir } = loadFlowWithMeta2(resolvedKey);
   const subContext = await executeFlow(
     subFlow,
@@ -3330,7 +3330,7 @@ function resolveBashEnv(envConfig, context, stepId) {
           os2.tmpdir(),
           `one-flow-${stepId}-${key}-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.json`
         );
-        fs4.writeFileSync(tmp, json, { encoding: "utf-8" });
+        fs4.writeFileSync(tmp, json, { encoding: "utf-8", mode: 384 });
         tempFiles.push(tmp);
         out[key] = tmp;
         continue;
@@ -3768,9 +3768,21 @@ var RUNS_DIR = ".one/flows/.runs";
 var LOGS_DIR = ".one/flows/.logs";
 function ensureDir(dir) {
   if (!fs5.existsSync(dir)) {
-    fs5.mkdirSync(dir, { recursive: true });
+    fs5.mkdirSync(dir, { recursive: true, mode: 448 });
   }
 }
+var PRIVATE_FILE_MODE = 384;
+var PRIVATE_DIR_MODE = 448;
+function restrictMode(p, mode) {
+  try {
+    fs5.chmodSync(p, mode);
+  } catch {
+  }
+}
+function persistableState(state) {
+  if (!state.context) return state;
+  return { ...state, context: { ...state.context, env: {} } };
+}
 function generateRunId() {
   return crypto.randomBytes(6).toString("hex");
 }
@@ -3789,6 +3801,8 @@ var FlowRunner = class _FlowRunner {
     this.flowKey = flow.key;
     ensureDir(RUNS_DIR);
     ensureDir(LOGS_DIR);
+    restrictMode(RUNS_DIR, PRIVATE_DIR_MODE);
+    restrictMode(LOGS_DIR, PRIVATE_DIR_MODE);
     this.statePath = path6.join(RUNS_DIR, `${flow.key}-${this.runId}.state.json`);
     this.logPath = path6.join(LOGS_DIR, `${flow.key}-${this.runId}.log`);
     const resolvedInputs = { ...inputs };
@@ -3831,10 +3845,15 @@ var FlowRunner = class _FlowRunner {
       msg,
       ...data
     };
-    fs5.appendFileSync(this.logPath, JSON.stringify(entry) + "\n");
+    fs5.appendFileSync(this.logPath, JSON.stringify(entry) + "\n", { mode: PRIVATE_FILE_MODE });
   }
   saveState() {
-    fs5.writeFileSync(this.statePath, JSON.stringify(this.state, stripStepsAlias, 2));
+    fs5.writeFileSync(
+      this.statePath,
+      JSON.stringify(persistableState(this.state), stripStepsAlias, 2),
+      { mode: PRIVATE_FILE_MODE }
+    );
+    restrictMode(this.statePath, PRIVATE_FILE_MODE);
   }
   createEventHandler(externalHandler) {
     return (event) => {
@@ -4169,6 +4188,7 @@ export {
   getStepTypeDescriptor,
   getNestedStepsKeys,
   generateFlowGuide,
+  persistableState,
   stripStepsAlias,
   FlowRunner,
   resolveFlowPath,

package/dist/{flow-runner-SRO6YL62.js → flow-runner-PUFQASEJ.js}

@@ -7,12 +7,13 @@ import {
   listFlows,
   loadFlow,
   loadFlowWithMeta,
+  persistableState,
   resolveFlowPath,
   saveFlow,
   stripStepsAlias,
   summarizeFlowInputs,
   walkSteps
-} from "./chunk-IM3OA7CU.js";
+} from "./chunk-33KUKSRH.js";
 import "./chunk-44CV5IMX.js";
 import "./chunk-Q6PWTATS.js";
 import "./chunk-XUAUDMQE.js";
@@ -25,6 +26,7 @@ export {
   listFlows,
   loadFlow,
   loadFlowWithMeta,
+  persistableState,
   resolveFlowPath,
   saveFlow,
   stripStepsAlias,

package/dist/index.js

@@ -40,7 +40,7 @@ import {
   validateActionInput,
   walkSteps,
   writeCache
-} from "./chunk-IM3OA7CU.js";
+} from "./chunk-33KUKSRH.js";
 import {
   memSqlCommand
 } from "./chunk-TSMVFVQ3.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withone/cli",
-  "version": "2.14.3",
+  "version": "2.14.4",
   "description": "CLI for managing One",
   "type": "module",
   "files": [