akm-cli 0.10.261012-beta → 0.10.261014-beta

package/dist/workflows/exec/environment.js

@@ -3,92 +3,28 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
  * Materialize a unit's frozen environment at dispatch. Env-file values are the
- * one deliberately live input to a frozen plan: freeze records each ref's
- * owner, key set and `${secret:…}` names; the values (and the secrets they
- * name) are read here, per dispatch, and nothing is returned until every read
- * has succeeded.
+ * one deliberately live input to a frozen plan: freeze records each env ref;
+ * the values (and the secrets and paths their `${ref}` tokens name) are read
+ * here, per dispatch, through `resolveEnvBinding` — the same machinery `akm env
+ * run` uses — and nothing is returned until every read has succeeded.
  */
-import fs from "node:fs";
-import path from "node:path";
-import dotenv from "dotenv";
-import { assetPathForName } from "../../core/asset/asset-placement.js";
-import { compareCodePoints, isWithin } from "../../core/common.js";
-import { NotFoundError, UsageError } from "../../core/errors.js";
-export const SECRET_TOKEN_RE = /\$\{secret:([A-Za-z0-9_./-]+)\}/g;
-export function materializeFrozenWorkflowEnvironment(descriptors, options = {}) {
+import { resolveEnvBinding } from "../../commands/env/env-binding.js";
+export function materializeFrozenWorkflowEnvironment(descriptors) {
     const values = {};
     const sensitive = new Set();
-    const audits = [];
     for (const descriptor of descriptors) {
         if (descriptor.kind === "literal") {
             values[descriptor.name] = descriptor.value;
-            if (descriptor.value)
-                sensitive.add(descriptor.value);
             continue;
         }
-        // `pass_env` names reach the exec child through its allowlist
-        // (`execAllowlist`, exec-unit.ts), not as bindings. Their values are
-        // deliberately not redacted, so they are neither read nor marked sensitive here.
+        // `pass_env` names are recorded in the plan and select nothing: the exec child inherits
+        // akm's environment (exec-unit.ts), so they are neither read nor marked sensitive here.
         if (descriptor.kind === "pass-through")
             continue;
-        const source = options.readEnvFile ? options.readEnvFile(descriptor) : readEnvFile(descriptor.owner);
-        const parsed = dotenv.parse(typeof source === "string" ? source : Buffer.from(source));
-        const keys = Object.keys(parsed).sort(compareCodePoints);
-        if (!sameStrings(keys, descriptor.keys))
-            invalid(`environment ${descriptor.ref} key set changed after it was frozen`);
-        const secretValues = new Map();
-        for (const name of descriptor.secretNames) {
-            const raw = options.readSecret ? options.readSecret({ name, descriptor }) : readSecret(descriptor.owner, name);
-            if (raw === undefined) {
-                throw new NotFoundError(`Environment ${descriptor.ref} references missing secret ${name}; nothing was materialized.`, "FILE_NOT_FOUND");
-            }
-            const value = typeof raw === "string" ? raw : Buffer.from(raw).toString("utf8");
-            secretValues.set(name, value);
-            if (value)
-                sensitive.add(value);
-        }
-        for (const [key, rawValue] of Object.entries(parsed)) {
-            const resolved = rawValue.replace(SECRET_TOKEN_RE, (_token, name) => {
-                const secret = secretValues.get(name);
-                if (secret === undefined)
-                    invalid(`environment ${descriptor.ref} secret ${name} was not frozen`);
-                return secret;
-            });
-            values[key] = resolved;
-            if (resolved)
-                sensitive.add(resolved);
-        }
-        audits.push({
-            eventType: "env_access",
-            ref: descriptor.ref,
-            keys: [...descriptor.keys],
-            secretNames: [...descriptor.secretNames],
-        });
-    }
-    return { values, sensitiveValues: [...sensitive], audits };
-}
-function readEnvFile(owner) {
-    if (!isWithin(owner.requestedPath, owner.requestedRoot))
-        invalid(`env file ${owner.relativePath} escapes its bundle`);
-    return fs.readFileSync(owner.requestedPath);
-}
-function readSecret(owner, name) {
-    const secretsRoot = path.join(owner.requestedRoot, "secrets");
-    const secretPath = assetPathForName("secret", secretsRoot, name);
-    if (!isWithin(secretPath, secretsRoot))
-        invalid(`secret name ${name} escapes its bundle`);
-    try {
-        return fs.readFileSync(secretPath);
-    }
-    catch (cause) {
-        if (cause.code === "ENOENT")
-            return undefined;
-        throw cause;
+        const binding = resolveEnvBinding(descriptor.ref);
+        Object.assign(values, binding.values);
+        for (const secret of binding.secretValues)
+            sensitive.add(secret);
     }
-}
-function sameStrings(left, right) {
-    return left.length === right.length && left.every((value, index) => value === right[index]);
-}
-function invalid(message) {
-    throw new UsageError(`Invalid frozen workflow environment: ${message}.`, "WORKFLOW_SOURCE_INVALID");
+    return { values, sensitiveValues: [...sensitive] };
 }

package/dist/workflows/exec/exec-unit.js

@@ -3,16 +3,13 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
  * The `exec` unit runner — the one place a frozen workflow spawns a command:
- * argv-only, detached with a SIGTERM→SIGKILL ladder against the process group,
- * cwd-contained by a resolved-path recheck, bounded (timeout, output bytes,
- * context size), with an allowlisted environment ({@link childEnv}). The
- * caller redacts the outcome before anything is journaled.
- * See docs/architecture/decisions/0003-child-env-allowlist-and-provenance.md.
+ * argv-only, detached with a SIGINT→SIGTERM→SIGKILL ladder against the process group,
+ * bounded (timeout, output bytes, context size), with the environment akm runs in
+ * ({@link childEnv}). The caller redacts the outcome before anything is journaled.
  */
 import fs from "node:fs";
 import path from "node:path";
-import { isWithinAsync } from "../../core/common.js";
-import { COMMON_SPAWN_ENV_PASSTHROUGH, collectAllowlistedEnv, WIN32_SPAWN_ENV_FLOOR } from "../../core/spawn-env.js";
+import { childProcessEnv } from "../../core/paths.js";
 import { runManagedSubprocess, streamCaptureFailure, } from "../../core/subprocess.js";
 import { warn } from "../../core/warn.js";
 import { execContextLimits, utf8Bytes, WORKFLOW_EXEC_OUTPUT_TRUNCATED_MARKER, WORKFLOW_MAX_EXEC_OUTPUT_BYTES, WORKFLOW_UNIT_DIAGNOSTIC_CLIP, } from "../resource-limits.js";
@@ -22,34 +19,10 @@ import { execContextLimits, utf8Bytes, WORKFLOW_EXEC_OUTPUT_TRUNCATED_MARKER, WO
  * of the composed message never cuts the tail.
  */
 const EXEC_STDERR_DIAGNOSTIC_CLIP = WORKFLOW_UNIT_DIAGNOSTIC_CLIP - 500;
-/**
- * The default environment allowlist for an exec unit's child (`exec.passEnv`
- * extends it): the agent-harness baseline plus names ordinary commands need
- * and `AKM_EVENT_SOURCE`. Credentials, cloud/CI vars, and proxies reach a
- * child only through `pass_env` or `env:`.
- */
-export const EXEC_DEFAULT_ENV_PASSTHROUGH = [
-    // PATH, HOME, USER, LANG, LC_ALL, TERM, TMPDIR, AKM_EVENT_SOURCE
-    ...COMMON_SPAWN_ENV_PASSTHROUGH,
-    // POSIX names a raw shell command needs beyond the agent baseline
-    "LOGNAME",
-    "SHELL",
-    "LC_CTYPE",
-    "TZ",
-    // SystemRoot, SystemDrive, WINDIR, COMSPEC, PATHEXT, USERPROFILE, HOMEDRIVE,
-    // HOMEPATH, TEMP, TMP. Named here as well as appended by `spawnEnvNamesFor`
-    // because this list is consumed on POSIX too, where nothing is appended.
-    ...WIN32_SPAWN_ENV_FLOOR,
-    // Windows toolchain roots, deliberately not part of the floor
-    "APPDATA",
-    "LOCALAPPDATA",
-    "ProgramData",
-    "ProgramFiles",
-];
 /**
  * Run one exec unit and map its outcome onto the dispatch vocabulary
  * (`non_zero_exit`, `timeout`, `aborted`, `spawn_failed` — retryable). The
- * `exec_*` reasons (cwd escape, output limit, context too large, incomplete
+ * `exec_*` reasons (output limit, context too large, incomplete
  * capture) are deliberately outside `retry.on`. Output overflow fails only a
  * unit that declared an `output:` schema.
  */
@@ -63,7 +36,7 @@ export async function runExecUnit(input) {
     const result = await runManagedSubprocess([...input.exec.command], {
         capture: true,
         cwd: cwd.path,
-        env: childEnv(input.exec, input.env, input.context, input.eventSource),
+        env: childEnv(input.env, input.context, input.eventSource),
         timeoutMs: input.timeoutMs,
         // stdout is the artifact; retention is bounded (discarding past the cap, never killing).
         maxOutputBytes: WORKFLOW_MAX_EXEC_OUTPUT_BYTES,
@@ -220,21 +193,11 @@ function contextTooLarge(input, what, names, limits) {
     };
 }
 /**
- * Resolve `exec.cwd` inside `baseDir` and prove containment against the
- * resolved base (a symlinked `reports` could point at `/etc`). Async: it runs
- * per unit on the dispatch path.
+ * Join `exec.cwd` onto `baseDir` once. `exec.cwd` may be relative or absolute and is not contained:
+ * the command is arbitrary code in its own right. Async: it runs per unit on the dispatch path.
  */
 async function resolveExecCwd(input) {
-    const base = path.resolve(input.baseDir);
-    const target = input.exec.cwd ? path.resolve(base, input.exec.cwd) : base;
-    if (!(await isWithinAsync(target, base))) {
-        return {
-            ok: false,
-            failureReason: "exec_cwd_escape",
-            error: `exec unit "${input.unitId}" declares cwd ${JSON.stringify(input.exec.cwd ?? ".")}, which resolves to ` +
-                `${target} — outside its working directory ${base}. Refusing to run outside the unit's tree.`,
-        };
-    }
+    const target = path.resolve(input.baseDir, input.exec.cwd ?? ".");
     if (!(await isExistingDirectory(target))) {
         return {
             ok: false,
@@ -253,12 +216,12 @@ async function isExistingDirectory(candidate) {
     }
 }
 /**
- * The child's environment, in precedence order: the allowlist plus
- * `exec.passEnv`; the resolved `env:` bindings; then the engine's `AKM_*`
- * context, last so a binding cannot shadow it.
+ * The child's environment, in precedence order: akm's own with the directories
+ * this akm resolved set over it ({@link childProcessEnv}); the resolved `env:`
+ * bindings; then the engine's `AKM_*` context, last so a binding cannot shadow it.
  */
-function childEnv(exec, bindings, context, eventSource) {
-    const env = collectAllowlistedEnv(execAllowlist(exec));
+function childEnv(bindings, context, eventSource) {
+    const env = childProcessEnv();
     // Only when absent from the base, and before the overlays, so ambient and authored values win.
     if (eventSource !== undefined && env.AKM_EVENT_SOURCE === undefined) {
         env.AKM_EVENT_SOURCE = eventSource;
@@ -269,10 +232,6 @@ function childEnv(exec, bindings, context, eventSource) {
         env[name] = value;
     return env;
 }
-/** The unit's effective allowlist: the shared default plus its own `passEnv` names. */
-function execAllowlist(exec) {
-    return exec.passEnv ? [...EXEC_DEFAULT_ENV_PASSTHROUGH, ...exec.passEnv] : [...EXEC_DEFAULT_ENV_PASSTHROUGH];
-}
 /** `argv[0]` plus its argument count — never the full argv, which can carry values. */
 function describeCommand(command) {
     const rest = command.length - 1;

package/dist/workflows/exec/frozen-judge.js

@@ -9,33 +9,39 @@
  * bindings (a step's environment belongs to the work, not the verifier).
  */
 import { warn } from "../../core/warn.js";
-import { collectWorkflowDispatchSensitiveValues, withDispatchRedaction } from "./dispatch-redaction.js";
-import { dispatchWorkflowExecution, prepareWorkflowExecution, } from "./unit-dispatch.js";
+import { mergeNotices } from "../../execution/notices.js";
+import { resolveRunBundleRoot } from "../runtime/workflow-asset-loader.js";
+import { dispatchWorkflowExecution } from "./unit-dispatch.js";
 /** The gate's node id — identical to what `journalGateEvaluationStart` writes. */
 export function gateNodeId(stepId) {
     return `${stepId}.gate`;
 }
+/**
+ * The root of the bundle the run's workflow lives in, found when the judge is built (a bundle update moves it).
+ * No frozen judge, no root needed. When the bundle does not resolve the judge is not built, and the error names the ref.
+ */
+export function resolveJudgeCwd(target, workflowRef) {
+    if (!target)
+        return undefined;
+    return resolveRunBundleRoot(workflowRef);
+}
 /** Identity for one judge dispatch: the caller's row identity, else the run/step with the gate node id. */
 function dispatchIdentity(owner, identity) {
     return identity ?? { ...owner, unitId: gateNodeId(owner.stepId) };
 }
-function warnLoweringNotices(...groups) {
-    const emitted = new Set();
-    for (const notices of groups) {
-        for (const notice of notices ?? []) {
-            const key = JSON.stringify([notice.code, notice.severity, notice.adapter, notice.field, notice.message]);
-            if (emitted.has(key))
-                continue;
-            emitted.add(key);
-            warn(`Workflow judge lowering notice (${notice.code}; ${notice.adapter}; ${notice.field}): ${notice.message}`);
-        }
+function warnLoweringNotices(notices) {
+    for (const notice of mergeNotices(notices) ?? []) {
+        warn(`Workflow judge lowering notice (${notice.code}; ${notice.adapter}; ${notice.field}): ${notice.message}`);
     }
 }
-/** Build a gate judge from the frozen target without consulting live config; `eventSource` stamps it like a unit. */
-export function frozenSummaryJudge(target, signal, dispatcher, owner, eventSource) {
+/**
+ * Build a gate judge from the frozen target without consulting live config; `eventSource` stamps it like a unit.
+ * `cwd` is the root of the run's bundle, where the judge works like every other agent dispatch.
+ */
+export function frozenSummaryJudge(target, signal, dispatcher, owner, eventSource, cwd) {
     if (!target)
         return null;
-    const dispatch = withDispatchRedaction(dispatcher ?? dispatchWorkflowExecution);
+    const dispatch = dispatcher ?? dispatchWorkflowExecution;
     return async ({ system, user }, identity) => {
         const id = dispatchIdentity(owner, identity);
         const commonRequest = {
@@ -52,26 +58,18 @@ export function frozenSummaryJudge(target, signal, dispatcher, owner, eventSourc
         const request = {
             ...commonRequest,
             frozenTarget: target,
+            ...(cwd !== undefined ? { cwd } : {}),
             timeoutMs: target.runner.timeoutMs ?? null,
             ...(eventSource !== undefined ? { eventSource } : {}),
         };
-        // Lowering and authorization precede every live credential/passthrough
-        // sample. The injected dispatcher may be a test seam, but it receives the
-        // exact same already-validated request and redaction declaration.
-        const lowered = prepareWorkflowExecution(request);
-        const sensitiveValues = collectWorkflowDispatchSensitiveValues({ runner: target.runner }, undefined);
-        const outcome = await dispatch({
-            ...request,
-            ...(sensitiveValues.length > 0 ? { sensitiveValues } : {}),
-        });
+        const outcome = await dispatch(request);
         if (outcome.usage && id.recordTokens) {
             id.recordTokens((outcome.usage.inputTokens ?? 0) + (outcome.usage.outputTokens ?? 0) + (outcome.usage.reasoningTokens ?? 0));
         }
-        // Only the common lowerer's own sanitized notices are loggable here. An
-        // injected dispatcher is not trusted to supply prompt/body-free messages.
-        warnLoweringNotices(lowered.notices);
+        // The dispatcher lowers the request once, and its notices are the lowerer's own sanitized ones.
+        warnLoweringNotices(outcome.notices);
         if (!outcome.ok) {
-            throw new Error(outcome.error || `Verification engine "${target.request.engine.name}" failed.`);
+            throw new Error(outcome.error || `Verification judge "${target.request.target.name}" failed.`);
         }
         return outcome.text ?? "";
     };