@yemi33/minions 0.1.2424 → 0.1.2425

package/engine/qa-process-validation.js

@@ -0,0 +1,572 @@
+'use strict';
+
+const apiValidation = require('./api-validation');
+const keepProcesses = require('./keep-process-sweep');
+const qaFromPrd = require('./qa-from-prd');
+const qaRunbooks = require('./qa-runbooks');
+const qaRuns = require('./qa-runs');
+const qaSessions = require('./qa-sessions');
+const shared = require('./shared');
+
+const {
+  ApiInputError,
+  validateEnum,
+  validateInteger,
+  validateIdentifier,
+  validatePlainObject,
+  validateRange,
+  validateString,
+} = apiValidation;
+
+function hasOwn(value, key) {
+  return Object.prototype.hasOwnProperty.call(value, key);
+}
+
+function detailPathForQaError(message, basePath = 'body') {
+  const match = String(message || '').match(
+    /^([A-Za-z_][A-Za-z0-9_]*(?:\[\d+\])?(?:\.[A-Za-z_][A-Za-z0-9_]*)?)/,
+  );
+  const fieldPath = match && match[1] !== 'spec' ? match[1] : '';
+  return fieldPath ? `${basePath}.${fieldPath}` : basePath;
+}
+
+function detailMetadata(pathName) {
+  const pathKey = String(pathName || '')
+    .replace(/^(?:body|path|query)\./, '')
+    .replace(/\[\d+\]/g, '[]');
+  const sessionLimits = qaSessions.LIMITS;
+  const runbookLimits = qaRunbooks.LIMITS;
+  const metadata = {
+    'target.kind': { allowedValues: [...qaSessions.VALID_TARGET_KINDS] },
+    'target.prId': { maxLength: sessionLimits.targetFieldMax },
+    'target.branch': { maxLength: sessionLimits.targetFieldMax },
+    'target.sha': { maxLength: sessionLimits.targetFieldMax },
+    'target.worktree': { maxLength: sessionLimits.targetFieldMax },
+    flowsRaw: { maxLength: sessionLimits.flowsMax },
+    mode: { allowedValues: [...qaSessions.VALID_MODES] },
+    runner: { maxLength: sessionLimits.runnerNameMax },
+    project: { maxLength: sessionLimits.projectMax },
+    projects: { maxLength: sessionLimits.projectsMax },
+    'projects[]': { maxLength: sessionLimits.projectMax },
+    'capture.video': { expected: 'boolean' },
+    'capture.screenshots': { expected: 'boolean' },
+    'capture.logs': { expected: 'boolean' },
+    id: { maxLength: runbookLimits.idMax },
+    name: { maxLength: runbookLimits.nameMax },
+    targetName: { maxLength: runbookLimits.targetNameMax },
+    steps: { maxLength: runbookLimits.stepsMax },
+    'steps[].description': { maxLength: runbookLimits.stepDescriptionMax },
+    'steps[].command': { maxLength: runbookLimits.stepCommandMax },
+    expectedArtifacts: { maxLength: runbookLimits.artifactsMax },
+    'expectedArtifacts[].type': { allowedValues: qaRunbooks.ARTIFACT_TYPES },
+    'expectedArtifacts[].label': { maxLength: runbookLimits.artifactLabelMax },
+    'expectedArtifacts[].path': { maxLength: runbookLimits.artifactPathMax },
+  };
+  return metadata[pathKey] || {};
+}
+
+function projectQaValidationErrors(errors, options = {}) {
+  const messages = Array.isArray(errors) && errors.length
+    ? errors
+    : ['Invalid QA request'];
+  const details = messages
+    .slice(0, apiValidation.API_INPUT_ERROR_DETAILS_MAX)
+    .map((message) => {
+      const detailPath = detailPathForQaError(message, options.basePath || 'body');
+      return {
+        code: options.detailCode || 'invalid-qa-field',
+        message,
+        path: detailPath,
+        ...detailMetadata(detailPath),
+      };
+    });
+  return new ApiInputError(options.message || 'Invalid QA request', {
+    code: options.code || 'invalid-qa-input',
+    statusCode: options.statusCode || 400,
+    details,
+  });
+}
+
+function unexpectedFields(value, allowedFields, pathName) {
+  const allowed = new Set(allowedFields);
+  return Object.keys(value)
+    .filter(field => !allowed.has(field))
+    .map(field => ({
+      code: 'unexpected-field',
+      message: `Unexpected field: ${field}`,
+      path: `${pathName}.${field}`,
+    }));
+}
+
+function validateObjectFields(value, allowedFields, pathName = 'body') {
+  validatePlainObject(value, { path: pathName });
+  const details = unexpectedFields(value, allowedFields, pathName);
+  if (details.length) {
+    throw new ApiInputError('Request contains unexpected fields', {
+      code: 'unexpected-field',
+      details,
+    });
+  }
+  return value;
+}
+
+function validateKnownRunner(runner, pathName) {
+  if (runner === undefined || runner === null || runner === '') return runner;
+  const qaRunners = require('./qa-runners');
+  if (!qaRunners.getRunner(runner)) {
+    throw new ApiInputError(`Unknown QA runner: ${runner}`, {
+      code: 'unknown-qa-runner',
+      path: pathName,
+      rejectedValue: runner,
+      allowedValues: qaRunners.listRunners().map(item => item.name),
+    });
+  }
+  return runner;
+}
+
+function validateQaIdentityHeaders(headers, options = {}) {
+  const source = headers || {};
+  let originAgent;
+  let ccTurnId;
+  if (hasOwn(source, 'x-minions-agent')) {
+    originAgent = validateString(source['x-minions-agent'], {
+      path: 'headers.X-Minions-Agent',
+      trim: true,
+      allowEmpty: false,
+      maxLength: keepProcesses.KEEP_PROCESS_AGENT_ID_MAX,
+    });
+    if (!keepProcesses.isSafeKeepProcessAgentId(originAgent)) {
+      throw new ApiInputError('Invalid X-Minions-Agent header', {
+        code: 'invalid-agent-id',
+        path: 'headers.X-Minions-Agent',
+        rejectedValue: originAgent,
+        maxLength: keepProcesses.KEEP_PROCESS_AGENT_ID_MAX,
+      });
+    }
+  }
+  if (options.allowCc === true && hasOwn(source, 'x-cc-turn-id')) {
+    ccTurnId = validateIdentifier(source['x-cc-turn-id'], {
+      path: 'headers.X-CC-Turn-Id',
+      trim: true,
+      maxLength: shared.CC_TURN_ID_MAX,
+    });
+  }
+  return { originAgent, ccTurnId };
+}
+
+function validateQaSessionRequest(body, options = {}) {
+  validateObjectFields(body, [
+    'target',
+    'flowsRaw',
+    'mode',
+    'capture',
+    'runner',
+    'project',
+    'projects',
+    'createdBy',
+  ]);
+  const result = qaSessions.validateSpec(body);
+  if (!result.ok) {
+    throw projectQaValidationErrors(result.errors, {
+      message: 'Invalid QA session specification',
+      code: 'invalid-qa-session',
+    });
+  }
+
+  const targetFields = {
+    pr: ['kind', 'prId'],
+    branch: ['kind', 'branch'],
+    current: ['kind', 'worktree'],
+    commit: ['kind', 'sha'],
+  };
+  validateObjectFields(body.target, targetFields[body.target.kind], 'body.target');
+  if (body.capture !== undefined && body.capture !== null) {
+    validateObjectFields(body.capture, ['video', 'screenshots', 'logs'], 'body.capture');
+  }
+  if (hasOwn(body, 'project') && body.project
+      && Array.isArray(body.projects) && body.projects.length) {
+    throw new ApiInputError('Use either project or projects, not both', {
+      code: 'conflicting-fields',
+      path: 'body.projects',
+      field: 'projects',
+    });
+  }
+  if (hasOwn(body, 'createdBy')) {
+    validateString(body.createdBy, {
+      path: 'body.createdBy',
+      maxLength: keepProcesses.KEEP_PROCESS_AGENT_ID_MAX,
+    });
+  }
+  if (options.validateRunner !== false) validateKnownRunner(body.runner, 'body.runner');
+  return body;
+}
+
+function validateQaRunbookRequest(body) {
+  validateObjectFields(body, [
+    'id',
+    'name',
+    'project',
+    'targetName',
+    'steps',
+    'expectedArtifacts',
+  ]);
+  const result = qaRunbooks.validateRunbook(body);
+  if (!result.ok) {
+    throw projectQaValidationErrors(result.errors, {
+      message: 'Invalid QA runbook',
+      code: 'invalid-qa-runbook',
+    });
+  }
+  body.steps.forEach((step, index) => {
+    validateObjectFields(step, ['description', 'command'], `body.steps[${index}]`);
+  });
+  body.expectedArtifacts.forEach((artifact, index) => {
+    validateObjectFields(artifact, ['type', 'label', 'path'], `body.expectedArtifacts[${index}]`);
+  });
+  return body;
+}
+
+function validateQaFromPrdRequest(body) {
+  validateObjectFields(body, ['prd', 'mode', 'runner']);
+  const prd = validateString(body.prd, {
+    path: 'body.prd',
+    trim: true,
+    allowEmpty: false,
+    maxLength: qaFromPrd.QA_PRD_FILENAME_MAX,
+  });
+  if (!qaFromPrd._isSafePrdFileName(prd)) {
+    throw new ApiInputError('prd must be a safe PRD filename', {
+      code: 'invalid-prd-filename',
+      path: 'body.prd',
+      rejectedValue: prd,
+      maxLength: qaFromPrd.QA_PRD_FILENAME_MAX,
+    });
+  }
+  if (hasOwn(body, 'mode')) {
+    validateEnum(body.mode, {
+      path: 'body.mode',
+      values: [...qaSessions.VALID_MODES],
+    });
+  }
+  if (hasOwn(body, 'runner') && body.runner !== null && body.runner !== '') {
+    validateString(body.runner, {
+      path: 'body.runner',
+      allowEmpty: false,
+      maxLength: qaSessions.LIMITS.runnerNameMax,
+    });
+    validateKnownRunner(body.runner, 'body.runner');
+  }
+  return { ...body, prd };
+}
+
+function validateQaRunbookRunRequest(body, options = {}) {
+  validateObjectFields(body, ['runbookId', 'targetName', 'agent']);
+  const runbookId = validateString(body.runbookId, {
+    path: 'body.runbookId',
+    trim: true,
+    allowEmpty: false,
+    maxLength: qaRunbooks.LIMITS.idMax,
+  });
+  if (!qaRunbooks._isSafeId(runbookId)) {
+    throw new ApiInputError('runbookId must be a safe kebab-case identifier', {
+      code: 'invalid-runbook-id',
+      path: 'body.runbookId',
+      rejectedValue: runbookId,
+      maxLength: qaRunbooks.LIMITS.idMax,
+    });
+  }
+  const targetName = validateString(body.targetName, {
+    path: 'body.targetName',
+    trim: true,
+    allowEmpty: false,
+    maxLength: qaRunbooks.LIMITS.targetNameMax,
+  });
+  let agent;
+  if (hasOwn(body, 'agent')) {
+    agent = validateString(body.agent, {
+      path: 'body.agent',
+      trim: true,
+      allowEmpty: false,
+      maxLength: keepProcesses.KEEP_PROCESS_AGENT_ID_MAX,
+    });
+    if (options.agents && !hasOwn(options.agents, agent)) {
+      throw new ApiInputError(`Unknown agent: ${agent}`, {
+        code: 'unknown-agent',
+        path: 'body.agent',
+        rejectedValue: agent,
+        allowedValues: Object.keys(options.agents),
+      });
+    }
+  }
+  return { runbookId, targetName, ...(agent ? { agent } : {}) };
+}
+
+function validateQaSessionActionRequest(body, action) {
+  const fieldsByAction = {
+    approve: [],
+    edit: ['feedback'],
+    cancel: ['reason'],
+    kill: ['reason'],
+    dismiss: ['summary'],
+  };
+  const allowedFields = fieldsByAction[action];
+  if (!allowedFields) throw new TypeError(`Unknown QA session action: ${action}`);
+  validateObjectFields(body, allowedFields);
+  if (action === 'edit') {
+    validateString(body.feedback, {
+      path: 'body.feedback',
+      trim: true,
+      allowEmpty: false,
+      maxLength: qaSessions.LIMITS.feedbackMax,
+    });
+  }
+  const optionalField = action === 'dismiss' ? 'summary' : 'reason';
+  if (allowedFields.includes(optionalField) && hasOwn(body, optionalField)) {
+    validateString(body[optionalField], {
+      path: `body.${optionalField}`,
+      maxLength: qaSessions.LIMITS.summaryMax,
+    });
+  }
+  return body;
+}
+
+function validateQaSessionActionState(session, action) {
+  const state = session && session.state;
+  if (action === 'approve' || action === 'edit') {
+    if (state !== qaSessions.QA_SESSION_STATE.AWAITING_APPROVAL) {
+      throw new ApiInputError(
+        `${action} requires state ${qaSessions.QA_SESSION_STATE.AWAITING_APPROVAL}, got ${state}`,
+        {
+          code: 'qa-session-state-conflict',
+          statusCode: 409,
+          path: 'state',
+          rejectedValue: state,
+          allowedValues: [qaSessions.QA_SESSION_STATE.AWAITING_APPROVAL],
+        },
+      );
+    }
+    return session;
+  }
+  const targetState = action === 'dismiss'
+    ? qaSessions.QA_SESSION_STATE.DONE
+    : qaSessions.QA_SESSION_STATE.KILLED;
+  try {
+    qaSessions.validateTransition(state, targetState);
+  } catch (cause) {
+    throw new ApiInputError(cause.message, {
+      code: 'qa-session-state-conflict',
+      statusCode: 409,
+      path: 'state',
+      rejectedValue: state,
+      cause,
+    });
+  }
+  return session;
+}
+
+function decodePathComponent(raw, options = {}) {
+  try {
+    return decodeURIComponent(String(raw || ''));
+  } catch (cause) {
+    throw new ApiInputError(`Invalid encoded ${options.label || 'path component'}`, {
+      code: options.code || 'invalid-path-encoding',
+      statusCode: options.statusCode || 400,
+      path: options.path || 'path',
+      cause,
+    });
+  }
+}
+
+function validateRunId(value, pathName = 'path.id') {
+  if (!qaRuns._isSafeRunId(value)) {
+    throw new ApiInputError('Invalid QA run id', {
+      code: 'invalid-qa-run-id',
+      path: pathName,
+      rejectedValue: value,
+      maxLength: qaRuns.QA_RUN_ID_MAX,
+    });
+  }
+  return value;
+}
+
+function validateSessionId(value, pathName = 'path.id') {
+  if (!qaSessions._isSafeSessionId(value)) {
+    throw new ApiInputError('Invalid QA session id', {
+      code: 'invalid-qa-session-id',
+      path: pathName,
+      rejectedValue: value,
+      maxLength: qaSessions.LIMITS.idMax,
+    });
+  }
+  return value;
+}
+
+function validateRunbookId(value, pathName = 'path.id') {
+  if (!qaRunbooks._isSafeId(value)) {
+    throw new ApiInputError('Invalid QA runbook id', {
+      code: 'invalid-qa-runbook-id',
+      path: pathName,
+      rejectedValue: value,
+      maxLength: qaRunbooks.LIMITS.idMax,
+    });
+  }
+  return value;
+}
+
+function validateManagedSpecName(value, pathName) {
+  const result = require('./managed-spawn').validateManagedSpecName(value);
+  if (!result.ok) {
+    throw new ApiInputError('Invalid managed process name', {
+      code: 'invalid-managed-process-name',
+      path: pathName,
+      rejectedValue: value,
+      maxLength: result.maxLength,
+    });
+  }
+  return result.value;
+}
+
+function validateManagedProcessActionRequest(body) {
+  validateObjectFields(body, ['name']);
+  return {
+    name: validateManagedSpecName(body.name, 'body.name'),
+  };
+}
+
+function validateKeepProcessKillRequest(body) {
+  validateObjectFields(body, ['agentId', 'pid']);
+  if (!keepProcesses.isSafeKeepProcessAgentId(body.agentId)) {
+    throw new ApiInputError('Invalid keep-process agent id', {
+      code: 'invalid-agent-id',
+      path: 'body.agentId',
+      rejectedValue: body.agentId,
+      maxLength: keepProcesses.KEEP_PROCESS_AGENT_ID_MAX,
+    });
+  }
+  const pidResult = keepProcesses.validateKeepProcessPid(body.pid);
+  if (!pidResult.ok) {
+    throw new ApiInputError('Invalid kept process PID', {
+      code: 'invalid-pid',
+      path: 'body.pid',
+      rejectedValue: body.pid,
+      min: 1,
+      max: keepProcesses.KEEP_PROCESS_PID_MAX,
+    });
+  }
+  return { agentId: body.agentId, pid: pidResult.value };
+}
+
+function validateQuery(urlValue, schemas = {}) {
+  const params = new URL(urlValue, 'http://localhost').searchParams;
+  for (const key of new Set(params.keys())) {
+    if (!hasOwn(schemas, key)) {
+      throw new ApiInputError(`Unexpected query parameter: ${key}`, {
+        code: 'unexpected-query-parameter',
+        path: `query.${key}`,
+      });
+    }
+    if (params.getAll(key).length !== 1) {
+      throw new ApiInputError(`Query parameter ${key} must be supplied once`, {
+        code: 'duplicate-query-parameter',
+        path: `query.${key}`,
+      });
+    }
+  }
+
+  const result = {};
+  for (const [key, schema] of Object.entries(schemas)) {
+    if (!params.has(key)) continue;
+    const raw = params.get(key);
+    if (schema.type === 'positive-integer') {
+      if (!/^[1-9]\d*$/.test(raw)) {
+        throw new ApiInputError(`${key} must be a positive integer`, {
+          code: 'invalid-integer',
+          path: `query.${key}`,
+          rejectedValue: raw,
+          min: 1,
+          ...(Number.isFinite(schema.max) ? { max: schema.max } : {}),
+        });
+      }
+      const value = Number(raw);
+      validateInteger(value, { path: `query.${key}` });
+      validateRange(value, { path: `query.${key}`, min: 1, max: schema.max });
+      result[key] = value;
+    } else if (schema.type === 'enum') {
+      result[key] = validateEnum(raw, {
+        path: `query.${key}`,
+        values: schema.values,
+      });
+    } else if (schema.type === 'string') {
+      result[key] = validateString(raw, {
+        path: `query.${key}`,
+        trim: schema.trim !== false,
+        allowEmpty: false,
+        maxLength: schema.maxLength,
+      });
+    } else {
+      throw new TypeError(`Unsupported query schema for ${key}`);
+    }
+  }
+  return result;
+}
+
+function validateConfiguredProject(value, projects, pathName = 'query.project') {
+  try {
+    shared.validateProjectName(value);
+  } catch (cause) {
+    throw new ApiInputError(cause.message, {
+      code: 'invalid-project',
+      path: pathName,
+      rejectedValue: value,
+      cause,
+    });
+  }
+  const project = shared.findProjectByName(projects, value);
+  if (!project) {
+    throw new ApiInputError(`Project not found: ${value}`, {
+      code: 'project-not-found',
+      statusCode: 404,
+      path: pathName,
+      rejectedValue: value,
+      allowedValues: (projects || []).map(item => item && item.name).filter(Boolean),
+    });
+  }
+  return project.name;
+}
+
+function requestHasBody(req) {
+  const contentLength = Number.parseInt(req && req.headers && req.headers['content-length'] || '0', 10);
+  return contentLength > 0 || !!(req && req.headers && req.headers['transfer-encoding']);
+}
+
+function rejectRequestBody(req) {
+  if (requestHasBody(req)) {
+    throw new ApiInputError('This route does not accept a request body', {
+      code: 'request-body-not-allowed',
+      path: 'body',
+    });
+  }
+}
+
+module.exports = {
+  projectQaValidationErrors,
+  validateObjectFields,
+  validateQaSessionRequest,
+  validateQaIdentityHeaders,
+  validateQaRunbookRequest,
+  validateQaFromPrdRequest,
+  validateQaRunbookRunRequest,
+  validateQaSessionActionRequest,
+  validateQaSessionActionState,
+  decodePathComponent,
+  validateRunId,
+  validateSessionId,
+  validateRunbookId,
+  validateManagedSpecName,
+  validateManagedProcessActionRequest,
+  validateKeepProcessKillRequest,
+  validateQuery,
+  validateConfiguredProject,
+  requestHasBody,
+  rejectRequestBody,
+};

package/engine/qa-runbooks.js

@@ -118,23 +118,24 @@ function validateRunbook(spec) {
   } else {
     if (spec.steps.length > LIMITS.stepsMax) {
       errors.push('steps exceeds max of ' + LIMITS.stepsMax);
-    }
-    for (let i = 0; i < spec.steps.length; i++) {
-      const s = spec.steps[i];
-      if (!s || typeof s !== 'object' || Array.isArray(s)) {
-        errors.push('steps[' + i + '] must be an object');
-        continue;
-      }
-      if (!_isNonEmptyString(s.description)) {
-        errors.push('steps[' + i + '].description is required (non-empty string)');
-      } else if (s.description.length > LIMITS.stepDescriptionMax) {
-        errors.push('steps[' + i + '].description exceeds ' + LIMITS.stepDescriptionMax + ' chars');
-      }
-      if (s.command !== undefined && s.command !== null) {
-        if (typeof s.command !== 'string') {
-          errors.push('steps[' + i + '].command must be a string when present');
-        } else if (s.command.length > LIMITS.stepCommandMax) {
-          errors.push('steps[' + i + '].command exceeds ' + LIMITS.stepCommandMax + ' chars');
+    } else {
+      for (let i = 0; i < spec.steps.length; i++) {
+        const s = spec.steps[i];
+        if (!s || typeof s !== 'object' || Array.isArray(s)) {
+          errors.push('steps[' + i + '] must be an object');
+          continue;
+        }
+        if (!_isNonEmptyString(s.description)) {
+          errors.push('steps[' + i + '].description is required (non-empty string)');
+        } else if (s.description.length > LIMITS.stepDescriptionMax) {
+          errors.push('steps[' + i + '].description exceeds ' + LIMITS.stepDescriptionMax + ' chars');
+        }
+        if (s.command !== undefined && s.command !== null) {
+          if (typeof s.command !== 'string') {
+            errors.push('steps[' + i + '].command must be a string when present');
+          } else if (s.command.length > LIMITS.stepCommandMax) {
+            errors.push('steps[' + i + '].command exceeds ' + LIMITS.stepCommandMax + ' chars');
+          }
         }
       }
     }
@@ -145,26 +146,27 @@ function validateRunbook(spec) {
   } else {
     if (spec.expectedArtifacts.length > LIMITS.artifactsMax) {
       errors.push('expectedArtifacts exceeds max of ' + LIMITS.artifactsMax);
-    }
-    for (let i = 0; i < spec.expectedArtifacts.length; i++) {
-      const a = spec.expectedArtifacts[i];
-      if (!a || typeof a !== 'object' || Array.isArray(a)) {
-        errors.push('expectedArtifacts[' + i + '] must be an object');
-        continue;
-      }
-      if (!_isNonEmptyString(a.type) || !ARTIFACT_TYPES.includes(a.type)) {
-        errors.push('expectedArtifacts[' + i + '].type must be one of: ' + ARTIFACT_TYPES.join(', '));
-      }
-      if (!_isNonEmptyString(a.label)) {
-        errors.push('expectedArtifacts[' + i + '].label is required (non-empty string)');
-      } else if (a.label.length > LIMITS.artifactLabelMax) {
-        errors.push('expectedArtifacts[' + i + '].label exceeds ' + LIMITS.artifactLabelMax + ' chars');
-      }
-      if (a.path !== undefined && a.path !== null) {
-        if (typeof a.path !== 'string') {
-          errors.push('expectedArtifacts[' + i + '].path must be a string when present');
-        } else if (a.path.length > LIMITS.artifactPathMax) {
-          errors.push('expectedArtifacts[' + i + '].path exceeds ' + LIMITS.artifactPathMax + ' chars');
+    } else {
+      for (let i = 0; i < spec.expectedArtifacts.length; i++) {
+        const a = spec.expectedArtifacts[i];
+        if (!a || typeof a !== 'object' || Array.isArray(a)) {
+          errors.push('expectedArtifacts[' + i + '] must be an object');
+          continue;
+        }
+        if (!_isNonEmptyString(a.type) || !ARTIFACT_TYPES.includes(a.type)) {
+          errors.push('expectedArtifacts[' + i + '].type must be one of: ' + ARTIFACT_TYPES.join(', '));
+        }
+        if (!_isNonEmptyString(a.label)) {
+          errors.push('expectedArtifacts[' + i + '].label is required (non-empty string)');
+        } else if (a.label.length > LIMITS.artifactLabelMax) {
+          errors.push('expectedArtifacts[' + i + '].label exceeds ' + LIMITS.artifactLabelMax + ' chars');
+        }
+        if (a.path !== undefined && a.path !== null) {
+          if (typeof a.path !== 'string') {
+            errors.push('expectedArtifacts[' + i + '].path must be a string when present');
+          } else if (a.path.length > LIMITS.artifactPathMax) {
+            errors.push('expectedArtifacts[' + i + '].path exceeds ' + LIMITS.artifactPathMax + ' chars');
+          }
         }
       }
     }
@@ -323,6 +325,8 @@ module.exports = {
   saveRunbook,
   deleteRunbook,
   // internals exposed for testing
+  _isSafeId,
+  _isSafeProjectName,
   _runbookPath,
   _runbooksDir,
 };