[aviggiano]

What changed

• Keep the documented unrestricted local-agent execution model while forwarding only active agent credentials and explicit operator-approved environment variables.
• Redact and bound durable workflow evidence and run-state errors without changing the raw operational input passed to Smithers.
• Pin CI actions and Codex installation, use exact generated runner dependencies, migrate the known legacy generated manifest, suppress install scripts, and validate the installed runner package and command shim.
• Bind eval credentials to their canonical HTTPS provider origins unless an operator explicitly trusts a custom origin; add request deadlines and response limits.
• Constrain ground truth and telemetry to verified files, revalidate uploaded bytes, and make failed telemetry delivery retryable.
• Harden the optional LLM judge against credential reuse, private-data release, injected identifiers, and classification downgrades; replace scoring outputs transactionally.
• Add dashboard CSP and baseline headers, externalize the theme bootstrap, cap JSON bodies, fix static asset cache policy, and harden audit-log append operations.

Deliberate non-goals

• No agent sandbox, approval gate, command allowlist, or egress allowlist is added. Dangerous execution modes remain an explicit product assumption.
• No multi-user authentication layer is added to the loopback-only dashboard.
• No broad materialization/lifecycle redesign, global economic budget system, read-time artifact transformation, or generic error-correlation subsystem is added.

This supersedes the overlapping draft implementations in #37 through #43. The independently correct path-validation change is already merged in #36, and the workspace build race that affected some draft checks is already fixed in #44.

Compatibility

Existing generated .smithers/package.json files using the previous exact legacy caret triplet are migrated in place while preserving custom fields and packages. Other modified core runner versions fail closed.

Validation

• pnpm install --frozen-lockfile
• pnpm run ci
• 210 tests passed; one optional Smithers CLI smoke test skipped because the CLI is not installed
• Supplemental references and dashboard package tests (the release validator does not invoke these two suites)
• Full workspace typecheck, lint, formatting, docs, release validation, and git diff --check
• Workflow YAML parse check

Greptile Summary

This PR applies security hardening across workflow execution, eval reporting, durable artifacts, and the dashboard. The main changes are:

• Restrict workflow environment forwarding and redact persisted evidence.
• Pin and validate generated runner dependencies and CI tooling.
• Bind eval credentials to approved HTTPS origins and bound network responses.
• Revalidate telemetry files and retry failed delivery.
• Harden LLM scoring, dashboard headers, request handling, and audit appends.

Confidence Score: 4/5

The unbounded body-drain path and uncapped heartbeat timeout need fixes before merging.

• Oversized chunked requests can hold a dashboard handler open before the 413 response.
• Long-running tasks can take their full execution timeout to detect a missing heartbeat.
• The remaining credential, telemetry, scoring, and durable-file changes have clear validation and failure handling.

packages/dashboard/src/index.ts; packages/runtime/src/smithers.ts

Security Review

The credential, file-validation, redaction, CSP, and audit-path changes strengthen the security boundaries. The dashboard body limiter still permits an oversized chunked request to consume unbounded input before rejection, leaving a loopback denial-of-service path.

Important Files Changed

Filename	Overview
packages/dashboard/src/index.ts	Adds security headers, body limits, safer caching, corrected asset lookup, and hardened audit appends; oversized chunked bodies are still drained without a bound.
packages/runtime/src/smithers.ts	Adds environment filtering, evidence redaction, exact runner validation, and template rendering, but removes the ten-minute heartbeat cap.
packages/runtime/src/start-run.ts	Forwards credentials for active workflow agents and explicit operator-approved environment variables.
packages/evals/src/node-telemetry.ts	Adds retryable delivery and validates manifest paths, file types, sizes, and hashes before uploads.
packages/evals/src/reporters/http.ts	Adds HTTPS-origin validation, explicit custom-origin trust, response limits, and request deadlines.
packages/evals/src/scoring.ts	Separates judge credentials, protects private inputs and identifiers, preserves deterministic matches, and replaces scoring outputs transactionally.
packages/artifacts/src/safe-paths.ts	Hardens durable append operations against symlinks and non-regular files.
packages/artifacts/src/state.ts	Redacts secret-like node errors before durable run-state persistence.

Comments Outside Diff (1)

1. packages/runtime/src/smithers.ts, line 776 (link)

   Heartbeat Timeout Loses Its Cap

   For a task with a long execution timeout, the heartbeat timeout now grows to the same value instead of remaining capped at ten minutes. If its worker stops sending heartbeats, the run can remain falsely active for hours rather than detecting the stalled worker after the previous ten-minute limit.

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: packages/runtime/src/smithers.ts
   Line: 776
   
   Comment:
   **Heartbeat Timeout Loses Its Cap**
   
   For a task with a long execution timeout, the heartbeat timeout now grows to the same value instead of remaining capped at ten minutes. If its worker stops sending heartbeats, the run can remain falsely active for hours rather than detecting the stalled worker after the previous ten-minute limit.
   
   
   
   How can I resolve this? If you propose a fix, please make it concise.

   

Prompt To Fix All With AI

Fix the following 2 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 2
packages/dashboard/src/index.ts:1638-1643
**Oversized Body Is Fully Drained**

When a chunked request exceeds 1 MiB, this loop keeps reading until the client ends the stream before returning 413. A local client can send an arbitrarily large or indefinitely slow body and keep the request open, so the new limit does not bound the server work.

### Issue 2 of 2
packages/runtime/src/smithers.ts:776
**Heartbeat Timeout Loses Its Cap**

For a task with a long execution timeout, the heartbeat timeout now grows to the same value instead of remaining capped at ten minutes. If its worker stops sending heartbeats, the run can remain falsely active for hours rather than detecting the stalled worker after the previous ten-minute limit.

```suggestion
  const heartbeatTimeoutMs = Math.min(600_000, timeoutMs);
```

_{Reviews (1): Last reviewed commit: "Apply lean security audit remediations" | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[aviggiano]

Smithers verifier approved this PR for merge.

Independently verified PR #45 (codex/audit-remediation) and approve it as ready. Worktree is clean with local HEAD == origin/codex/audit-remediation == PR head d3467b5, exactly one commit ahead of origin/main with a clean git merge-tree (no conflicts). Fresh gh query confirms the PR is OPEN, MERGEABLE, mergeStateStatus CLEAN, with all 9 status checks SUCCESS on this exact head (release-gates x2, Ultrafuzz target E2E for Aave v4 / Very Liquid Vaults / StableSwapNG Vyper, Greptile, Socket x2, semgrep) — the UNSTABLE state in the task prompt is stale. Re-checked approved-author feedback fresh: zero aviggiano PR comments, reviews, or inline comments, matching the provided 0/0/0 context; the only review activity is a greptile-apps[bot] comment, which is outside the approved-author set and ignored per the security policy. The 37-file diff matches the PR body's stated scope (workflows, docs, artifacts, config, dashboard, evals, runtime). Deterministic validation all passed (git diff --check, format:check, prompts tests 24/24, docs:check), and my independent spot-check of the two most-touched packages passed: evals 51/51 and artifacts suites green with full dependency-chain builds succeeding. Heavy repo-wide validation is already green on GitHub Actions for this head, so nothing further is left for local CI. No changes were needed; nothing new to push.

GitHub checks passed for PR #45; merge state is CLEAN.