Bundle workflow package files for remote runs

[brynary]

Summary

• Bundle UTF-8 regular files under workflow-local scripts/, references/, and assets/ directories.
• Carry these files in manifest version 2 and write them into fresh remote sandboxes before hooks and setup commands run.
• Reject traversal, symlinks, invalid paths, conflicting destinations, non-UTF-8 content, more than 256 files, and bundles larger than 5 MiB.
• Keep manifest version 1 when a workflow has no package files.

Convention

.fabro/workflows/security-review/
├── workflow.toml
├── workflow.fabro
├── scripts/
├── references/
└── assets/

Fabro scans only the three package directories. It preserves each path relative to the run working directory. Local runs continue to use files on disk. Fresh Docker and Daytona sandboxes receive bundled files after initialization and before workflow preparation.

Verification

• cargo nextest run -p fabro-manifest
• cargo nextest run -p fabro-workflow
• cargo nextest run -p fabro-server
• cargo build --workspace
• cargo +nightly-2026-04-14 fmt --check --all
• cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings
• bun run typecheck in lib/packages/fabro-api-client

[Copilot]

Pull request overview

This pull request introduces support for bundling workflow package files (scripts/, references/, assets/) into run manifests (schema v2) and materializing them into fresh remote sandboxes before hooks and setup/preparation run, enabling remote runs to access workflow-local runtime assets without relying on a git clone of uncommitted files.

Changes:

• Add runtime_files to the workflow manifest schema and API client models, and bump manifest schema to v2 only when runtime files are present.
• Implement collection, validation, and size/count limiting of workflow package files during manifest build; validate and materialize these files into remote sandboxes during initialization.
• Add server-side manifest parsing/validation for v2 runtime files, including path safety checks, conflict detection, and limit enforcement.

Reviewed changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
lib/packages/fabro-api-client/src/models/run-manifest.ts	Updates manifest version documentation to note v2 runtime files.
lib/packages/fabro-api-client/src/models/manifest-workflow.ts	Adds runtime_files to the TS workflow model.
lib/components/fabro-workflow/src/workflow_bundle.rs	Adds runtime file constants, path validation helper, and runtime_files to BundledWorkflow with tests.
lib/components/fabro-workflow/src/pipeline/initialize.rs	Writes bundled runtime files into fresh remote sandboxes before hooks/prep; adds test coverage for write ordering.
lib/components/fabro-workflow/src/operations/start.rs	Updates test bundle construction to include runtime_files.
lib/components/fabro-workflow/src/operations/create.rs	Updates validation tests to include runtime_files.
lib/components/fabro-workflow/src/handler/manager_loop.rs	Updates test workflow bundle construction to include runtime_files.
lib/components/fabro-manifest/src/lib.rs	Scans workflow package dirs, bundles UTF-8 files into runtime_files, enforces limits, and selects manifest v2 when needed (with tests).
lib/components/fabro-manifest/Cargo.toml	Adds walkdir dependency for runtime file directory traversal.
lib/apps/fabro-server/src/server/handler/runs.rs	Raises request body limits for manifest-related endpoints.
lib/apps/fabro-server/src/run_manifest.rs	Accepts manifest v2, validates runtime file constraints, and converts runtime_files into the workflow bundle safely.
docs/public/api-reference/fabro-api.yaml	Extends OpenAPI schema with runtime_files and updates manifest version description.
Cargo.lock	Locks walkdir dependency addition.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.