security: Harden remote cache output hydration against undeclared paths

[milesj]

Summary

• Normalize remote cache output paths before writing them to disk.
• Reject absolute paths, traversal outside the workspace, and cache entries that are not declared outputs.
• Keep declared directory outputs working while also protecting symlink targets.
• Add a security note to the changelog and a regression suite covering the malicious cache cases.

Testing

• cargo test -p moon_task_runner --test output_hydrater_test -- --nocapture
• cargo check -p moon_task_runner
• cargo clippy -p moon_task_runner --all-targets -- -D warnings
• Local validation confirmed the new tests block traversal, absolute-path, and undeclared-output hydration while preserving valid directory hydration.

[Copilot]

Pull request overview

Hardens moon_task_runner remote/local cache output hydration by normalizing and validating output paths before writing to disk, preventing compromised cache manifests from writing outside the workspace or outside declared outputs.

Changes:

• Added workspace-root and “declared output” path resolution in OutputHydrater before writing hydrated files/symlinks.
• Introduced a new task-runner error for undeclared hydrated outputs and added regression tests for traversal/absolute/undeclared hydration attempts.
• Refactored OutputArchiver/OutputHydrater construction behind new(...) constructors and documented the security fix in the changelog.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
crates/task-runner/src/output_hydrater.rs	Enforces path normalization + workspace/output-declaration checks before writing hydrated outputs and creating symlinks.
crates/task-runner/src/task_runner_error.rs	Adds a new error variant for rejecting undeclared hydrated outputs.
crates/task-runner/tests/output_hydrater_test.rs	Adds regression coverage for directory-output hydration and malicious cache manifest paths (traversal/absolute/undeclared).
crates/task-runner/tests/utils.rs	Updates test helpers to construct archiver/hydrater via new constructors.
crates/task-runner/src/output_archiver.rs	Introduces a constructor and makes fields private to centralize initialization.
crates/task-runner/src/task_runner.rs	Updates TaskRunner to construct archiver/hydrater via new(...).
crates/daemon-server/src/daemon_server.rs	Updates daemon archiving path to use OutputArchiver::new(...).
CHANGELOG.md	Adds an Unreleased security note describing the cache-hydration overwrite fix.

[codspeed-hq]

Merging this PR will improve performance by 35.83%

⚠️ Unknown Walltime execution environment detected

Using the Walltime instrument on standard Hosted Runners will lead to inconsistent data.

For the most accurate results, we recommend using CodSpeed Macro Runners: bare-metal machines fine-tuned for performance measurement consistency.

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 3 improved benchmarks
✅ 20 untouched benchmarks

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
⚡	WallTime	load_one	40.8 ms	29.5 ms	+38.15%
⚡	WallTime	load_all	138.5 ms	102.2 ms	+35.5%
⚡	WallTime	load_many	57.3 ms	42.8 ms	+33.87%

Tip

Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing codex/verify-moon-vulnerability-fix (037227a) with master (01793e7)}

[codspeed-hq]

Unable to generate the flame graphs

The performance report has correctly been generated, but there was an internal error while generating the flame graphs for this run. We're working on fixing the issue. Feel free to contact us on Discord or at support@codspeed.io if the issue persists.