Upload canonical sanitized agent transcripts

Author: chubes4

.github/scripts/run-agent-task/prepare-agent-task-upload.mjs

@@ -1,6 +1,8 @@
 import { constants } from "node:fs"
 import { lstat, mkdir, open, readdir, readFile, rm, writeFile } from "node:fs/promises"
 import { isUtf8 } from "node:buffer"
+import { createHash } from "node:crypto"
+import { fileURLToPath, pathToFileURL } from "node:url"
 import { isAbsolute, join, relative, resolve } from "node:path"
 import { assertNoRuntimeSourcePaths, sanitizeRuntimeSourceJson } from "./runtime-source-sanitizer.mjs"
 
@@ -14,6 +16,7 @@ const runtimeSourceRoot = process.env.WP_CODEBOX_RUNTIME_SOURCE_ROOT ? resolve(p
 const runtimeSourcePrefix = process.env.WP_CODEBOX_RUNTIME_SOURCE_PREFIX ? resolve(process.env.WP_CODEBOX_RUNTIME_SOURCE_PREFIX) : ""
 const runtimeSourceRoots = [runtimeSourceRoot, runtimeSourcePrefix].filter(Boolean)
 const privateUploadRoots = [...runtimeSourceRoots, workspace]
+const codeboxRoot = resolve(fileURLToPath(new URL("../../..", import.meta.url)))
 const SOURCE_TREE = /(^|\/)(prepared-plugins|prepared-source-packages|source-package[^/]*)(\/|$)/i
 const SOURCE_FILE = /\.(?:php|phtml|js|mjs|cjs|jsx|ts|tsx)$/i
 const PHP_OPENING_TAG = /<\?(?:php|=)(?:\s|$)/i
@@ -34,6 +37,7 @@ function redact(value) {
 
 function sanitizeText(text) {
   return sanitizeRuntimeSourceJson(text, privateUploadRoots)
+    .replace(/\/(?:Users|home|private|var|tmp|opt|Volumes)\/[^\s"'\\]+/g, "[host-path]")
 }
 
 function compactNativeInput(text) {
@@ -135,12 +139,38 @@ async function stageTextFile(source, destination, options = {}) {
   const text = redact(sanitizeSeedSnapshotJson(sanitized))
   assertNoRuntimeSourcePaths(text, privateUploadRoots, "Runtime source or workspace paths must never be persisted in artifact uploads.")
   assertNoSeedSnapshotPaths(text)
-  if (containsRuntimeSourceContent(text)) throw new Error("Prepared runtime plugin source contents must never be staged for artifact upload.")
+  if (!options.allowTargetCode && containsRuntimeSourceContent(text)) throw new Error("Prepared runtime plugin source contents must never be staged for artifact upload.")
   await mkdir(resolve(destination, ".."), { recursive: true })
   await writeFile(destination, text)
   return true
 }
 
+async function canonicalTranscript(result) {
+  const publicCore = await import(pathToFileURL(join(codeboxRoot, "packages/runtime-core/dist/public.js")).href)
+  const refs = publicCore.normalizePublicArtifactRefDTOs(record(result).runtime_result)
+    .filter((ref) => ref.kind === "codebox-transcript")
+  if (refs.length === 0) return undefined
+  if (refs.length !== 1 || !safeRelativeArtifactPath(refs[0].path)) throw new Error("Canonical transcript requires exactly one trusted codebox-transcript path.")
+  return refs[0]
+}
+
+async function stageCanonicalTranscript(result) {
+  const ref = await canonicalTranscript(result)
+  if (!ref) return undefined
+  const path = safeRelativeArtifactPath(ref.path)
+  const source = resolve(artifactsPath, path)
+  if (relative(artifactsPath, source).startsWith("..") || sourceCategory(path, source)) throw new Error("Canonical transcript must stay under the trusted artifact root.")
+  const destination = join(uploadPath, ".codebox", "agent-task-artifacts", "transcript.json")
+  if (!await stageTextFile(source, destination, { allowTargetCode: true })) throw new Error("Canonical transcript must be a bounded regular UTF-8 file.")
+  const bytes = await readFile(destination)
+  if (!Object.keys(record(parseJsonOrEmpty(bytes.toString("utf8")))).length) throw new Error("Canonical transcript must be a JSON object.")
+  return {
+    path: ".codebox/agent-task-artifacts/transcript.json",
+    sha256: createHash("sha256").update(bytes).digest("hex"),
+    provenance: { kind: ref.kind, artifact_path: path, ...(ref.sha256 ? { source_sha256: ref.sha256 } : {}) },
+  }
+}
+
 function record(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {}
 }
@@ -171,7 +201,7 @@ function declaredArtifactPaths(result, allowed) {
   return [...paths].sort()
 }
 
-async function exclusions(root, declaredPaths) {
+async function exclusions(root, declaredPaths, transcript) {
   const counts = new Map()
   const count = (category) => counts.set(category, (counts.get(category) || 0) + 1)
   const visit = async (directory) => {
@@ -188,7 +218,10 @@ async function exclusions(root, declaredPaths) {
     }
   }
   await visit(root)
-  return [...counts.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([category, count]) => ({ category, count }))
+  return {
+    exclusions: [...counts.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([category, count]) => ({ category, count })),
+    ...(transcript ? { canonical_transcripts: [transcript] } : {}),
+  }
 }
 
 function runtimeProvenance(request) {
@@ -216,7 +249,7 @@ async function finalScan(directory) {
       const text = isUtf8(bytes) ? bytes.toString("utf8") : ""
       assertNoRuntimeSourcePaths(text, privateUploadRoots, "Runtime source or workspace paths must never be persisted in artifact uploads.")
       assertNoSeedSnapshotPaths(text)
-      if (containsRuntimeSourceContent(text)) throw new Error("Prepared runtime plugin source contents must never be persisted in artifact uploads.")
+      if (relativePath !== ".codebox/agent-task-artifacts/transcript.json" && containsRuntimeSourceContent(text)) throw new Error("Prepared runtime plugin source contents must never be persisted in artifact uploads.")
     } else throw new Error("Only regular files may be persisted in artifact uploads.")
   }
 }
@@ -237,11 +270,14 @@ await stageTextFile(join(workspace, ".codebox", "native-agent-task-input.json"),
 for (const path of declaredPaths) {
   const source = resolve(artifactsPath, path)
   if (relative(artifactsPath, source).startsWith("..") || sourceCategory(path, source)) {
-    throw new Error("Declared reviewer artifacts must not reference source files or private runtime internals.")
+    // Package declarations cannot authorize source trees or escape the root.
+    // Keep staging independent of an untrusted alias, including transcripts.
+    continue
   }
   await stageTextFile(source, join(uploadPath, ".codebox", "agent-task-artifacts", path))
 }
+const transcript = await stageCanonicalTranscript(result)
 await mkdir(join(uploadPath, ".codebox", "agent-task-artifacts"), { recursive: true })
 await writeFile(join(uploadPath, ".codebox", "agent-task-artifacts", "runtime-provenance.json"), `${JSON.stringify({ schema: "wp-codebox/agent-task-runtime-provenance/v1", sources: runtimeProvenance(request) }, null, 2)}\n`)
-await writeFile(join(uploadPath, ".codebox", "agent-task-artifacts", "exclusions.json"), `${JSON.stringify({ schema: "wp-codebox/agent-task-upload-exclusions/v1", exclusions: await exclusions(artifactsPath, declaredPaths) }, null, 2)}\n`)
+await writeFile(join(uploadPath, ".codebox", "agent-task-artifacts", "exclusions.json"), `${JSON.stringify({ schema: "wp-codebox/agent-task-upload-exclusions/v1", ...(await exclusions(artifactsPath, declaredPaths, transcript)) }, null, 2)}\n`)
 await finalScan(uploadPath)

docs/agent-runtime-contract.md

@@ -176,6 +176,8 @@ Generic command runners and host tool registries should write tool-call evidence
 
 The artifact verifier checks that transcript artifact refs are listed in `manifest.json`, stay within the bundle, and match their declared SHA-256 digests when present. This lets a generic command runner branch merge by materializing its command/tool transcript into `files/runtime-evidence/tool-calls/transcript.json` and appending the referenced input/output artifacts through the existing runtime-evidence manifest update path.
 
+The reusable agent-task workflow separately uploads one normalized `codebox-transcript` ref for reviewer diagnostics. It accepts exactly one bounded, regular, non-symlink JSON file under its trusted artifact root, stages it as `.codebox/agent-task-artifacts/transcript.json`, and records the source ref plus staged SHA-256 in the upload exclusions manifest. This reviewer copy removes secrets and private host/runtime/source/snapshot paths while retaining target-relative tool arguments, errors, and model messages; package declarations cannot authorize alternate transcript paths or dependency source files.
+
 ## Runner Workspace Publication
 
 Runner workspace publication is a separate exported contract in runtime-core:

docs/agent-task-reusable-workflow.md

@@ -139,7 +139,14 @@ runner token, so a fabricated publication result cannot satisfy the gate.
 
 The result artifact includes the executable task input, normalized runtime
 result, evaluated projections, verification records, and runner-owned
-publication result. Runtime input, result, and diagnostics are uploaded from
+publication result. A single canonical `codebox-transcript` ref from the
+normalized runtime result is staged independently of package declarations at
+`.codebox/agent-task-artifacts/transcript.json`. The uploader accepts only a
+bounded regular UTF-8 file beneath the trusted artifact root, records its
+source provenance and staged digest in `exclusions.json`, and sanitizes secrets
+and private runtime, workspace, and snapshot paths while preserving
+target-relative tool arguments, errors, and model messages. Runtime source
+trees remain excluded. Runtime input, result, and diagnostics are uploaded from
 `workspace/.codebox/` with `if: always()`, including execution failures. A request
 artifact alone is not a successful task result.
 

tests/runtime-sources-materialization.test.ts

@@ -164,6 +164,30 @@ await withTempDir("wp-codebox-runtime-source-upload-", async (directory) => {
   await writeFile(join(workspace, ".codebox", "agent-task-workflow-result.json"), JSON.stringify({ typed_artifacts: [{ name: "reviewer-report", type: "report", artifact: { path: "safe.json" } }] }))
   await execFileAsync(process.execPath, [script.pathname], { env: { ...process.env, AGENT_TASK_WORKSPACE: workspace, AGENT_TASK_UPLOAD_PATH: upload, WP_CODEBOX_RUNTIME_SOURCE_ROOT: privateRoot } })
   assert.match(await readFile(join(upload, ".codebox", "agent-task-artifacts", "safe.json"), "utf8"), /OpenAiProvider/)
+  await mkdir(join(artifacts, "files"), { recursive: true })
+  await writeFile(join(artifacts, "files", "transcript.json"), JSON.stringify({
+    model_message: "Target snippet: <?php final class Target_Plugin {}",
+    tool_calls: [{ tool_id: "workspace.read", args: { path: "src/plugin.php" }, error: "Repeated workspace error" }, { tool_id: "workspace.read", args: { path: "src/plugin.php" }, error: "Repeated workspace error" }],
+    private_path: `${privateRoot}/source.php`,
+    host_path: "/Users/example/private-log.txt",
+    token: "secret-transcript-value",
+  }))
+  await writeFile(join(workspace, ".codebox", "agent-task-workflow-result.json"), JSON.stringify({ runtime_result: { agent_task_run_result: { refs: { transcripts: [{ kind: "codebox-transcript", path: "files/transcript.json", sha256: "a".repeat(64) }] } } }, typed_artifacts: [{ name: "reviewer-report", type: "report", artifact: { path: "prepared-plugins/agents-api/agents-api.php" } }] }))
+  await execFileAsync(process.execPath, [script.pathname], { env: { ...process.env, AGENT_TASK_WORKSPACE: workspace, AGENT_TASK_UPLOAD_PATH: upload, WP_CODEBOX_RUNTIME_SOURCE_ROOT: privateRoot, OPENAI_API_KEY: "secret-transcript-value" } })
+  const transcript = await readFile(join(upload, ".codebox", "agent-task-artifacts", "transcript.json"), "utf8")
+  assert.match(transcript, /Target snippet: <\?php/)
+  assert.match(transcript, /Repeated workspace error/)
+  assert.doesNotMatch(transcript, /private-runtime-source|secret-transcript-value|\/Users\/example/)
+  const transcriptExclusions = await readFile(join(upload, ".codebox", "agent-task-artifacts", "exclusions.json"), "utf8")
+  assert.match(transcriptExclusions, /canonical_transcripts/)
+  assert.match(transcriptExclusions, /codebox-transcript/)
+  const outsideTranscript = join(directory, "outside-transcript.json")
+  await writeFile(outsideTranscript, JSON.stringify({ secret: "outside" }))
+  await rm(join(artifacts, "files", "transcript.json"))
+  await symlink(outsideTranscript, join(artifacts, "files", "transcript.json"))
+  await assert.rejects(execFileAsync(process.execPath, [script.pathname], { env: { ...process.env, AGENT_TASK_WORKSPACE: workspace, AGENT_TASK_UPLOAD_PATH: upload, WP_CODEBOX_RUNTIME_SOURCE_ROOT: privateRoot } }), /bounded regular UTF-8 file/, "Canonical transcript refs cannot follow symlinks outside artifacts")
+  await rm(join(artifacts, "files", "transcript.json"))
+  await writeFile(join(artifacts, "files", "transcript.json"), JSON.stringify({ tool_calls: [] }))
   await writeFile(join(artifacts, "leak.json"), `runtime log ${privateRoot}/source.php`)
   await writeFile(join(workspace, ".codebox", "agent-task-workflow-result.json"), JSON.stringify({ status: "failed", success: false, typed_artifacts: [{ name: "reviewer-report", type: "report", artifact: { path: "leak.json" } }] }))
   await execFileAsync(process.execPath, [script.pathname], { env: { ...process.env, AGENT_TASK_WORKSPACE: workspace, AGENT_TASK_UPLOAD_PATH: upload, WP_CODEBOX_RUNTIME_SOURCE_ROOT: privateRoot } })
@@ -179,8 +203,8 @@ await withTempDir("wp-codebox-runtime-source-upload-", async (directory) => {
   assert.match(exclusionManifest, /"category": "source-tree"/)
   assert.doesNotMatch(exclusionManifest, /prepared-plugins|agents-api|private-runtime-source/)
   await writeFile(join(workspace, ".codebox", "agent-task-workflow-result.json"), JSON.stringify({ typed_artifacts: [{ name: "reviewer-report", type: "report", artifact: { path: "prepared-plugins/agents-api/agents-api.php" } }] }))
-  await assert.rejects(execFileAsync(process.execPath, [script.pathname], { env: { ...process.env, AGENT_TASK_WORKSPACE: workspace, AGENT_TASK_UPLOAD_PATH: upload, WP_CODEBOX_RUNTIME_SOURCE_ROOT: privateRoot } }), /Declared reviewer artifacts/)
-  assert.ok(await readFile(join(upload, ".codebox", "agent-task-workflow-result.json"), "utf8"), "Declared artifact rejection preserves the normalized control result")
+  await execFileAsync(process.execPath, [script.pathname], { env: { ...process.env, AGENT_TASK_WORKSPACE: workspace, AGENT_TASK_UPLOAD_PATH: upload, WP_CODEBOX_RUNTIME_SOURCE_ROOT: privateRoot } })
+  await assert.rejects(readFile(join(upload, ".codebox", "agent-task-artifacts", "prepared-plugins", "agents-api", "agents-api.php"), "utf8"), /ENOENT/, "Package-declared source aliases never reach the upload")
   await rm(join(artifacts, "prepared-plugins"), { recursive: true, force: true })
   for (const path of ["runtime-source-disguised.json", "runtime-source-disguised.txt"]) {
     await writeFile(join(artifacts, path), await readFile(new URL(`../fixtures/agent-task-upload/${path}`, import.meta.url), "utf8"))