Repository navigation
Fix redaction, condition and template handling in the engine - #755
Merged
Merged
Conversation
- a matches condition with an invalid pattern, a regex timeout or an overlong input fails the run instead of evaluating to false - GitHub tokens are masked except for their prefix - log steps and returned data redact private keys before truncating, also without an end marker - text file edits replace the file in place and keep its ACL - breakpoint conditions resolve manual inputs - substituted values that look like templates no longer count as unresolved references Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| // through the secret redactor so a `message: "pw={{step.param.pw}}"` won't leak. | ||
| var sanitized = SanitizeForLog(rawMessage); | ||
| // Redact complete values before flattening lines or truncating delimiters. | ||
| var sanitized = SanitizeForLog(_redactor.Redact(rawMessage) ?? rawMessage); |
| return true; | ||
|
|
||
| var resolved = VariableResolver.ResolveStringValue(node.Data.BreakpointCondition, previousResults, outputVariableToStepId, globalVariables) ?? ""; | ||
| var resolved = VariableResolver.ResolveStringValue(node.Data.BreakpointCondition, previousResults, outputVariableToStepId, globalVariables, inputParameters) ?? ""; |
| [Fact] | ||
| public async Task EditProtectedFile_PreservesAccessRulesAndRemovesStagingFile() | ||
| { | ||
| var directory = Path.Combine(Path.GetTempPath(), "np-text-acl-" + Guid.NewGuid().ToString("N")); |
| { | ||
| var directory = Path.Combine(Path.GetTempPath(), "np-text-acl-" + Guid.NewGuid().ToString("N")); | ||
| Directory.CreateDirectory(directory); | ||
| var path = Path.Combine(directory, "protected.txt"); |
Closed
2 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Third of the smaller PRs that replace #752. It contains engine runtime fixes only: no database change, no API contract change. RT05/RT06 (notifications, with a migration) and the debugger snapshot change get their own PRs.
matchescondition with an invalid pattern, a regex timeout or an input above 1,048,576 characters throwsConditionEvaluationException. The run fails and names the edge. Before, this evaluated tofalse, which a surroundingnotcould invert. ADR 0015 now says so.gh?_prefix. Before, the regex kept the whole token as its retained group.logandreturnDataredact before truncating. A private key without an end marker is masked to the end of the value.textFileEditwrites a staging file that carries the original ACL, then swaps it in withFile.Replace. That keeps the DACL and metadata;Move-Itemused to reset them to the inherited permissions.{{manual.*}}.{{…}}stays literal and no longer fails the step.Changelog updated.
Checked locally:
TemplateGrammarParityTests: 219.NodePilot.Engine.Tests: 3,423 passed. One failure,AgentSkillTests.ShippedSccmRevisionMatchesItsValidatedSourceFiles, comes from stale CRLF sample files in this working copy (.gitattributessays LF). It does not occur on a fresh checkout.Closes #680
Closes #681
Closes #682
Closes #683
Closes #685
Closes #686
🤖 Generated with Claude Code