GGitHubfix(security): standardize standalone runtimes on Node 24.22.1 (#6365)

f0556919创建于 9 天前历史提交

文件	最后提交记录	最后更新时间
src	feat(evidence): save and open reviewer checkpoints on Daytona (#5924) * feat(evidence): save and open reviewer checkpoints on Daytona Capture forks the running world (seconds, the test continues), saves the fork as a memory snapshot named after the checkpoint, then deletes it. The review app opens a reviewer's own copy from that snapshot behind a signed Daytona host plus the in-VM gateway's access cookie. Checkpoint records name their provider, so old reports keep opening on the provider that saved them. web-checkpoint-fork now runs on the selected provider. * fix(evidence): accept browser requests from the Daytona signed viewer origin Daytona's preview proxy rewrites Host, so the in-VM gateway's same-origin checks (HTTP and the noVNC WebSocket) rejected the viewer page. Copies now record each signed origin they were issued in access.json allowedOrigins and the gateway accepts exactly those. Freestyle access files have no such list, so Freestyle keeps its Host-based checks unchanged.	18 天前
README.md	feat(evidence): choose Freestyle or Daytona for CI evidence worlds (#5893) * refactor(evidence): choose the evidence sandbox provider by setting Adds @openwork/evidence-provider: the OPENWORK_EVIDENCE_PROVIDER setting (freestyle \| daytona, unset = freestyle), the provider-neutral checkpoint record, and the ReviewPreviewProvider interface the review app calls. Freestyle now implements that interface (@openwork/freestyle/review-provider); the review app picks the provider for new previews from the setting and opens each checkpoint with the provider that saved it. CI's core and checkpoint lanes pass the repository variable through; core-web uses evidenceWeb(), which dispatches on it. Daytona can be selected but fails clearly until its implementation lands. No behavior change while the setting is unset. * feat(evidence): run the CI evidence world on Daytona Linux VMs (#5902) Adds @openwork/daytona-evidence: the same evidence world as Freestyle's (same in-VM steps and controller files), built in cached Daytona layers: a Ubuntu 24.04 VM base with Node and Bun, a warm image per dev dependency set, and each commit's world saved running (memory snapshot). Tests start a copy and drive its browser through Daytona's private per-port URL plus the in-VM gateway's access cookie. OPENWORK_EVIDENCE_PROVIDER=daytona now runs core-chat and the checkpoint lane on Daytona (checkpoints themselves land with reviewer previews). The dev warm-up keeps both providers warm; the hourly cleanup also reclaims Daytona snapshots and sandboxes. * fix(daytona-evidence): trim trailing URL slashes in linear time CodeQL js/polynomial-redos flagged /\/+$/ on provider-supplied URLs. * fix(evidence): address Warden findings on provider credentials and base image - Cleanup and dev warm-up hold both provider keys: run only on the default branch, including manual dispatches, and check out the default branch. - Daytona base: install a pinned Node release verified against a checksum in the recipe instead of running NodeSource's mutable setup script.	18 天前
package.json	fix(security): standardize standalone runtimes on Node 24.22.1 (#6365) * fix(security): standardize standalone runtimes on Node 24.22.1 Pin runtime images, CI and downloads to the October security release; preserve artifact verification and require patched Node 24 in standalone launchers. Update standalone Undici, add runtime baseline and Helm probe regression coverage, and document the separate rebuild/deployment and Electron follow-ups. * fix(security): pin setup-node in image publication workflow Resolve the security review by replacing the mutable v6 action ref with its verified full commit SHA. Add a regression check that rejects mutable setup-node refs in the package-write workflow; retain Warden's human-approval safeguard.	9 天前
tsconfig.json	feat(evidence): choose Freestyle or Daytona for CI evidence worlds (#5893) * refactor(evidence): choose the evidence sandbox provider by setting Adds @openwork/evidence-provider: the OPENWORK_EVIDENCE_PROVIDER setting (freestyle \| daytona, unset = freestyle), the provider-neutral checkpoint record, and the ReviewPreviewProvider interface the review app calls. Freestyle now implements that interface (@openwork/freestyle/review-provider); the review app picks the provider for new previews from the setting and opens each checkpoint with the provider that saved it. CI's core and checkpoint lanes pass the repository variable through; core-web uses evidenceWeb(), which dispatches on it. Daytona can be selected but fails clearly until its implementation lands. No behavior change while the setting is unset. * feat(evidence): run the CI evidence world on Daytona Linux VMs (#5902) Adds @openwork/daytona-evidence: the same evidence world as Freestyle's (same in-VM steps and controller files), built in cached Daytona layers: a Ubuntu 24.04 VM base with Node and Bun, a warm image per dev dependency set, and each commit's world saved running (memory snapshot). Tests start a copy and drive its browser through Daytona's private per-port URL plus the in-VM gateway's access cookie. OPENWORK_EVIDENCE_PROVIDER=daytona now runs core-chat and the checkpoint lane on Daytona (checkpoints themselves land with reviewer previews). The dev warm-up keeps both providers warm; the hourly cleanup also reclaims Daytona snapshots and sandboxes. * fix(daytona-evidence): trim trailing URL slashes in linear time CodeQL js/polynomial-redos flagged /\/+$/ on provider-supplied URLs. * fix(evidence): address Warden findings on provider credentials and base image - Cleanup and dev warm-up hold both provider keys: run only on the default branch, including manual dispatches, and check out the default branch. - Daytona base: install a pinned Node release verified against a checksum in the recipe instead of running NodeSource's mutable setup script.	18 天前

@openwork/evidence-provider

Chooses which sandbox provider runs evidence worlds (CI journeys and their checkpoints) and reviewer previews, and defines what each provider must offer.

OPENWORK_EVIDENCE_PROVIDER=freestyle|daytona selects it: a GitHub repository variable for CI (pr-proof.yml) and the same variable in the review app's environment. Unset means freestyle.
./checkpoint: the checkpoint record stored in evidence reports. It names the provider that saved it, so old reports keep opening with that provider after the default changes.
./review: ReviewPreviewProvider, what the review app calls to build, launch and open checkpoints.

Implementations: @openwork/freestyle/review-provider and evals/packages/env/src/freestyle-evidence.ts. Daytona can be selected but fails with a clear "not supported yet" error until its implementation lands.