Harden immutable runtime source isolation

Author: chubes4

.github/scripts/run-agent-task/execute-native-agent-task.mjs

@@ -13,6 +13,7 @@ const outputPath = process.env.GITHUB_OUTPUT
 const MAX_CAPTURE_BYTES = 32768
 const MAX_OUTPUT_CHARS = 8192
 const secretValues = ["OPENAI_API_KEY", "MODEL_PROVIDER_SECRET_1", "MODEL_PROVIDER_SECRET_2", "MODEL_PROVIDER_SECRET_3", "MODEL_PROVIDER_SECRET_4", "MODEL_PROVIDER_SECRET_5", "GITHUB_TOKEN", "GH_TOKEN", "ACCESS_TOKEN", "EXTERNAL_PACKAGE_SOURCE_POLICY"].map((name) => process.env[name]).filter(Boolean)
+const PRIVATE_RUNTIME_PATH_FIELDS = new Set(["source", "path", "sourceRoot", "originalSource", "preparedPath", "requestedPath", "source_package_root", "artifacts_path", "runtime_input_path", "task_path", "result_path", "event_stream_path", "materialization_result_path"])
 function redact(value) {
   if (typeof value === "string") return secretValues.reduce((output, secret) => output.split(secret).join("[REDACTED]"), value)
   if (Array.isArray(value)) return value.map(redact)
@@ -95,6 +96,27 @@ function record(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {}
 }
 
+function isPrivateRuntimePath(value) {
+  if (!privateRuntimeSourceRoot || typeof value !== "string") return false
+  const path = resolve(value)
+  return path === privateRuntimeSourceRoot || path.startsWith(`${privateRuntimeSourceRoot}/`)
+}
+
+function omitPrivateRuntimeSourcePaths(value) {
+  if (Array.isArray(value)) return value.map(omitPrivateRuntimeSourcePaths)
+  if (!value || typeof value !== "object") return value
+  return Object.fromEntries(Object.entries(value).flatMap(([key, entry]) => {
+    if (PRIVATE_RUNTIME_PATH_FIELDS.has(key) && isPrivateRuntimePath(entry)) return []
+    return [[key, omitPrivateRuntimeSourcePaths(entry)]]
+  }))
+}
+
+function assertNoPrivateRuntimePaths(value) {
+  if (privateRuntimeSourceRoot && JSON.stringify(value).includes(privateRuntimeSourceRoot)) {
+    throw new Error("Runtime source paths must never be persisted in workflow results or artifacts.")
+  }
+}
+
 function string(value) {
   return typeof value === "string" ? value.trim() : ""
 }
@@ -244,6 +266,7 @@ const runtimeSourceInputs = (materializedRuntimeSources?.lowered ?? []).reduce((
   return input
 }, {})
 const sourcePackageRoot = privateRuntimeSourceRoot ? join(privateRuntimeSourceRoot, "prepared-packages") : artifactsPath
+const executionInputPath = privateRuntimeSourceRoot ? join(privateRuntimeSourceRoot, "native-agent-task-input.json") : runtimeInputPath
 
 const taskInput = {
   schema: "wp-codebox/agent-task-run-request/v1",
@@ -297,20 +320,23 @@ const taskInput = {
   },
 }
 
-await writeFile(runtimeInputPath, `${JSON.stringify(taskInput, null, 2)}\n`)
+await writeFile(executionInputPath, `${JSON.stringify(taskInput, null, 2)}\n`)
 
 let execution = { code: 0, stdout: "", stderr: "", stdout_truncated: false, stderr_truncated: false }
 if (request.run_agent && !request.dry_run) {
-  execution = await command("node", [codeboxCliPath, "agent-task-run", "--input-file", runtimeInputPath, "--result-file", nativeResultPath], workspace, agentEnvironment())
+  execution = await command("node", [codeboxCliPath, "agent-task-run", "--input-file", executionInputPath, "--result-file", nativeResultPath], workspace, agentEnvironment())
 }
 
 // Public package bytes are embedded in the runtime recipe and consumed only by
 // the Playground bootstrap before the agent's tools are resolved.
 
-const runtimeResult = request.run_agent && !request.dry_run
+const nativeRuntimeResult = request.run_agent && !request.dry_run
   ? await readNativeResult(nativeResultPath, controlledCodeboxPath, secretValues, redact)
   : {}
 await rm(nativeResultPath, { force: true })
+assertNoPrivateRuntimePaths(nativeRuntimeResult)
+const runtimeResult = omitPrivateRuntimeSourcePaths(nativeRuntimeResult)
+assertNoPrivateRuntimePaths(runtimeResult)
 await cleanupPrivateRuntimeSources()
 
 await redactArtifactFiles(artifactsPath)

.github/scripts/run-agent-task/materialize-external-native-package.mjs

@@ -121,7 +121,7 @@ function normalizeRuntimeArtifactPolicy(value) {
   for (const entry of value) {
     const artifact = entry && typeof entry === "object" && !Array.isArray(entry) ? entry : {}
     const url = normalizeHttpsUrl(artifact.url, "EXTERNAL_PACKAGE_SOURCE_POLICY runtime_artifacts.url")
-    const sha256 = artifact.sha256 === undefined ? "" : normalizeSha256(artifact.sha256, "EXTERNAL_PACKAGE_SOURCE_POLICY runtime_artifacts.sha256")
+    const sha256 = normalizeSha256(artifact.sha256, "EXTERNAL_PACKAGE_SOURCE_POLICY runtime_artifacts.sha256")
     if (Object.hasOwn(artifacts, url)) throw new Error("EXTERNAL_PACKAGE_SOURCE_POLICY runtime_artifacts must not repeat URLs.")
     artifacts[url] = sha256
   }
@@ -189,7 +189,7 @@ function normalizeHttpsZipRuntimeSource(source, artifact, policy, label) {
   if (Object.keys(artifact).some((key) => !["type", "url", "sha256", "archive_root"].includes(key))) throw new Error(`${label}.source https_zip contains an unsupported field.`)
   const expectedDigest = policy.runtime_artifacts?.[url]
   if (expectedDigest === undefined) throw new Error("Runtime artifact URL is not authorized.")
-  if (expectedDigest && expectedDigest !== sha256) throw new Error("Runtime artifact digest does not match its trusted policy.")
+  if (expectedDigest !== sha256) throw new Error("Runtime artifact digest does not match its trusted policy.")
   const metadata = source.metadata && typeof source.metadata === "object" && !Array.isArray(source.metadata) ? source.metadata : {}
   return { version: 1, role, source: { type: "https_zip", url, sha256, ...(archive_root ? { archive_root } : {}) }, metadata: normalizeRuntimeMetadata(role, metadata, label) }
 }

.github/scripts/run-agent-task/prepare-agent-task-upload.mjs

@@ -1,5 +1,5 @@
 import { constants } from "node:fs"
-import { lstat, mkdir, open, readdir, rm, writeFile } from "node:fs/promises"
+import { lstat, mkdir, open, readdir, readFile, rm, writeFile } from "node:fs/promises"
 import { isUtf8 } from "node:buffer"
 import { join, resolve } from "node:path"
 
@@ -14,17 +14,33 @@ function redact(value) {
   return secretValues.reduce((output, secret) => output.split(secret).join("[REDACTED]"), value)
 }
 
+const PRIVATE_RUNTIME_PATH_FIELDS = new Set(["source", "path", "sourceRoot", "originalSource", "preparedPath", "requestedPath", "source_package_root", "artifacts_path", "runtime_input_path", "task_path", "result_path", "event_stream_path", "materialization_result_path"])
+
+function isPrivateRuntimePath(value) {
+  if (!runtimeSourceRoot || typeof value !== "string") return false
+  const path = resolve(value)
+  return path === runtimeSourceRoot || path.startsWith(`${runtimeSourceRoot}/`)
+}
+
 function omitPrivateRuntimeSourcePaths(value) {
   if (Array.isArray(value)) return value.map(omitPrivateRuntimeSourcePaths)
   if (!value || typeof value !== "object") return value
   return Object.fromEntries(Object.entries(value).flatMap(([key, entry]) => {
-    if (runtimeSourceRoot && typeof entry === "string" && resolve(entry).startsWith(runtimeSourceRoot) && ["source", "path", "sourceRoot", "originalSource", "preparedPath", "requestedPath"].includes(key)) return []
+    if (PRIVATE_RUNTIME_PATH_FIELDS.has(key) && isPrivateRuntimePath(entry)) return []
     return [[key, omitPrivateRuntimeSourcePaths(entry)]]
   }))
 }
 
+function sanitizeText(text) {
+  try {
+    return `${JSON.stringify(omitPrivateRuntimeSourcePaths(JSON.parse(text)), null, 2)}\n`
+  } catch {
+    return text
+  }
+}
+
 async function stageFile(source, destination) {
-  if (runtimeSourceRoot && resolve(source).startsWith(runtimeSourceRoot)) {
+  if (isPrivateRuntimePath(source)) {
     throw new Error("Runtime source files must never be staged for artifact upload.")
   }
   const metadata = await lstat(source).catch(() => null)
@@ -37,9 +53,7 @@ async function stageFile(source, destination) {
   if (!contents || contents.includes(0) || !isUtf8(contents)) return false
   await mkdir(resolve(destination, ".."), { recursive: true })
   let text = contents.toString("utf8")
-  if (source === join(workspace, ".codebox", "native-agent-task-input.json")) {
-    text = `${JSON.stringify(omitPrivateRuntimeSourcePaths(JSON.parse(text)), null, 2)}\n`
-  }
+  text = sanitizeText(text)
   if (runtimeSourceRoot && text.includes(runtimeSourceRoot)) throw new Error("Runtime source paths must never be persisted in artifact uploads.")
   await writeFile(destination, redact(text))
   return true
@@ -56,10 +70,22 @@ async function stageDirectory(source, destination) {
   }
 }
 
+async function assertNoPrivateRuntimePaths(directory) {
+  for (const entry of await readdir(directory, { withFileTypes: true })) {
+    const path = join(directory, entry.name)
+    if (entry.isDirectory()) await assertNoPrivateRuntimePaths(path)
+    else if (entry.isFile()) {
+      const contents = await readFile(path, "utf8")
+      if (runtimeSourceRoot && contents.includes(runtimeSourceRoot)) throw new Error("Runtime source paths must never be persisted in artifact uploads.")
+    }
+  }
+}
+
 await rm(uploadPath, { recursive: true, force: true })
 await mkdir(uploadPath, { recursive: true })
 await stageFile(requestPath, join(uploadPath, ".codebox", "agent-task-request.json"))
 for (const path of [".codebox/agent-task-workflow-result.json", ".codebox/native-agent-task-input.json"]) {
   await stageFile(join(workspace, path), join(uploadPath, path))
 }
 await stageDirectory(join(workspace, ".codebox", "agent-task-artifacts"), join(uploadPath, ".codebox", "agent-task-artifacts"))
+await assertNoPrivateRuntimePaths(uploadPath)

docs/agent-task-reusable-workflow.md

@@ -56,7 +56,7 @@ This release-coherence contract fixes [#1759](https://github.com/Automattic/wp-c
 - `external_package_source`: immutable descriptor with `repository`, full commit `revision`, one package-relative `.agent.json` `path`, and `digest`. Packages are supported only from publicly accessible GitHub repositories, fetched from canonical `https://github.com/OWNER/REPOSITORY.git` without credentials. `digest` is exactly `sha256-bytes-v1:<lowercase-sha256>` over the raw file bytes; filenames and JSON content are UTF-8-safe and are not normalized before hashing.
 - `EXTERNAL_PACKAGE_SOURCE_POLICY`: required reusable-workflow secret, supplied by the caller's operator-controlled secret configuration. Its strict version 1 JSON shape is `{"version":1,"repositories":{"owner/repository":["agents/example.agent.json"]}}`. Every entry is an exact standalone `.agent.json` path. The policy is validated in runner memory, is never part of task input, and is not uploaded.
 
-`runtime_sources` is an optional versioned JSON array for immutable public runtime dependencies. Git descriptors declare `version: 1`, `role` (`component`, `provider_plugin`, or `bundled_library`), `repository`, a full 40-character `revision`, exact directory `path`, optional `sha256-git-archive-v1` digest, and role metadata. Component and provider descriptors may instead declare `source: {"type":"https_zip","url":"https://...","sha256":"<64 lowercase hex>","archive_root":"plugin-directory"}`. The operator-controlled policy separately authorizes Git sources with `runtime_sources` and exact ZIP URLs with `runtime_artifacts`, for example `{"version":1,"repositories":{},"runtime_artifacts":[{"url":"https://downloads.wordpress.org/plugin/example.zip","sha256":"<64 lowercase hex>"}]}`. ZIP downloads require HTTPS, an exact allowlisted URL, a matching descriptor digest, bounded transfer and extraction sizes, and redirects only to another allowlisted URL on the original host. The runner verifies the digest before extraction; rejects traversal, symlink, special-file, encrypted, ZIP64, oversized, and multi-root archives; stages under a private temp root outside the workspace and artifacts; and removes the staging root after execution. Runtime source descriptors lower into existing component, provider plugin, and runtime overlay inputs; artifacts retain provenance only.
+`runtime_sources` is an optional versioned JSON array for immutable public runtime dependencies. Git descriptors declare `version: 1`, `role` (`component`, `provider_plugin`, or `bundled_library`), `repository`, a full 40-character `revision`, exact directory `path`, optional `sha256-git-archive-v1` digest, and role metadata. Component and provider descriptors may instead declare `source: {"type":"https_zip","url":"https://...","sha256":"<64 lowercase hex>","archive_root":"plugin-directory"}`. The operator-controlled policy separately authorizes Git sources with `runtime_sources` and exact ZIP URLs with `runtime_artifacts`, for example `{"version":1,"repositories":{},"runtime_artifacts":[{"url":"https://downloads.wordpress.org/plugin/example.zip","sha256":"<64 lowercase hex>"}]}`. Every exact `runtime_artifacts` URL requires `sha256`; the descriptor digest must exactly equal that trusted policy digest, so callers cannot authorize mutable current bytes. ZIP downloads require HTTPS, an exact allowlisted URL, a matching descriptor digest, bounded transfer and extraction sizes, and redirects only to another allowlisted URL on the original host. The runner verifies the digest before extraction; rejects traversal, symlink, special-file, encrypted, ZIP64, oversized, and multi-root archives; stages under a private temp root outside the workspace and artifacts; removes the staging root after execution; and strips private materialization paths from upload staging before scanning staged files for leaks. Runtime source descriptors lower into existing component, provider plugin, and runtime overlay inputs; artifacts retain provenance only.
 - `target_repo`: `OWNER/REPO` target repository.
 - `prompt`, `writable_paths`, provider/model, `max_turns`, `time_budget_ms`, callback data, and artifact declarations: native task inputs.
 - `runner_workspace`: JSON runner-workspace publication request owned by the package.