feat(engine/sink)!: require relative paths in sink output

.gitignore

@@ -5,3 +5,4 @@
 reearth-flow-websocket/
 reearth-flow-websocket-rs/
 target/
+.local-specs/

CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to this project will be documented in this file.
 
+## Unreleased
+
+### Breaking changes
+
+- **engine/sink**: Sink `output` parameters now require a **relative path**.
+  The engine joins the path against the per-job artifact directory
+  (`sandbox_root`) internally; workflow authors no longer prefix with
+  `Url(env["workerArtifactPath"]) / ...`.
+
+  **Migration**: Replace `output: { type: flowExpr, value: 'Url(env["workerArtifactPath"]) / "x"' }`
+  with `output: { type: string, value: "x" }` (static) or
+  `output: { type: flowExpr, value: '"x_" + attributes["k"]' }` (dynamic).
+  The equivalent `file::join_path(env.get("workerArtifactPath"), "x")` form
+  also migrates to just `"x"`.
+
+  Workflows that still use the old absolute-URI form fail at runtime with
+  an error message that names `workerArtifactPath` — search your logs for
+  that keyword to locate workflows that need migration.
+
+  All built-in plateau example fixtures (87 files) have been migrated as
+  part of this release.
+
 ## 0.1.0-alpha.17 - 2026-05-26
 
 ### Web

engine/AGENTS.md

@@ -61,25 +61,45 @@ Use the `add-action` skill for a full step-by-step guide including i18n workflow
 
 ### Sandbox & sink writes
 
-Every executor context carries a `sandbox_root: Uri` field that bounds where
-sink actions are allowed to write. The chokepoint is
-`reearth_flow_action_sink::SinkOutput::from_path`, which validates the
-destination URI against `ctx.sandbox_root` via `sandbox::ensure_under` before
-acquiring a storage handle.
+Sinks accept a **relative path** for their `output` parameter. The engine
+joins the path against `ctx.sandbox_root` (the per-job artifact directory)
+and validates the result via `sandbox::ensure_under`. The chokepoint is
+`reearth_flow_action_sink::SinkOutput::from_path`.
+
+Workflow authors write:
+
+```yaml
+output:
+  type: string
+  value: "out.gpkg"           # or "group/a.geojson", with attribute concat for dynamic names
+```
+
+The engine joins this against whatever `sandbox_root` the worker/CLI was
+launched with — `file:///var/jobs/abc/`, `gs://bucket/jobs/abc/`,
+`ram:///jobs/abc/`, etc. The same workflow YAML is portable across storage
+backends.
+
+`SinkOutput::from_path` rejects:
+- Empty strings, leading/trailing whitespace, literal `.` / `..`
+- Absolute URIs (`scheme://...`) — error message names `workerArtifactPath`
+  to direct customers to the migration
+- Leading `/` (ambiguous) or leading `~` (home expansion not supported)
+- Paths that resolve to the artifact directory itself after normalization
+- Paths that escape the sandbox via `..` (caught by `ensure_under`)
 
 **All sink-side writes MUST go through `SinkOutput`.** Calling
-`Storage::put_sync` (or any other raw I/O like `std::fs::write`) from a sink
-or sink-adjacent code path skips the check and reintroduces unbounded
-writes. If a new sink format or sidecar write is needed, route it through
-`SinkOutput::from_path` / `SinkOutput::join` / `SinkOutput::write`. Reviewers
-should flag any direct `put_sync` / `std::fs` calls in sink code as
-regressions.
+`Storage::put_sync` (or any other raw I/O like `std::fs::write`) from a
+sink or sink-adjacent code path skips the check and reintroduces
+unbounded writes. If a new sink format or sidecar write is needed, route
+it through `SinkOutput::from_path` / `SinkOutput::join` /
+`SinkOutput::write`. Reviewers should flag any direct `put_sync` /
+`std::fs` calls in sink code as regressions.
 
 Production entrypoints (`Runner::run_with_sandbox_root`,
 `AsyncRunner::run_with_sandbox_root`) reject the `file:///` sentinel so a
 misconfigured `workerArtifactPath` cannot silently disable the sandbox.
-`Runner::run` (legacy / tests) intentionally uses that sentinel and bypasses
-the guard.
+`Runner::run` (legacy / tests) intentionally uses that sentinel and
+bypasses the guard.
 
 ## Key Constraints
 

engine/Cargo.toml

@@ -21,7 +21,7 @@ homepage = "https://github.com/reearth/reearth-flow"
 license = "MIT OR Apache-2.0"
 repository = "https://github.com/reearth/reearth-flow"
 rust-version = "1.93.1" # Remember to update clippy.toml as well
-version = "0.0.375"
+version = "0.0.376"
 
 [profile.dev]
 opt-level = 0

engine/runtime/action-processor/src/feature/writer.rs

@@ -2,7 +2,7 @@ mod citygml;
 mod csv;
 mod json;
 
-use std::{collections::HashMap, str::FromStr, sync::Arc};
+use std::{collections::HashMap, sync::Arc};
 
 use indexmap::IndexMap;
 use reearth_flow_common::{csv::Delimiter, uri::Uri};
@@ -255,8 +255,15 @@ impl Processor for FeatureWriter {
         let path = scope
             .eval_ast::<String>(&output)
             .map_err(|e| FeatureProcessorError::FeatureWriterFactory(format!("{e:?}")))?;
-        let output = Uri::from_str(path.as_str())?;
-        let buffer = self.buffer.entry(output).or_default();
+        // Use SinkOutput::from_path so the path is validated as strict-relative
+        // and joined against sandbox_root, rather than against CWD.
+        let sink_out = reearth_flow_action_sink::SinkOutput::from_path(
+            &NodeContext::from(ctx.clone()),
+            path.as_str(),
+        )
+        .map_err(|e| FeatureProcessorError::FeatureWriterFactory(format!("{e}")))?;
+        let output_uri = sink_out.uri().clone();
+        let buffer = self.buffer.entry(output_uri).or_default();
         buffer.push(ctx.feature);
         Ok(())
     }
@@ -278,12 +285,13 @@ impl Processor for FeatureWriter {
                 ),
             ])
             .into();
-            // Enforce sandbox: CSV/TSV/JSON/CityGML all write directly to
-            // `output`; without this check `FeatureWriter` would be an
-            // out-of-sandbox escape hatch alongside the sink writers.
+            // Defense-in-depth: ctx.sandbox_root was validated at buffer-insertion
+            // time in process() via SinkOutput::from_path, but ctx here may be a
+            // different NodeContext at flush time. Re-verify before each write to
+            // keep the sandbox gate co-located with put_sync.
             reearth_flow_action_sink::ensure_under(&ctx.sandbox_root, output).map_err(|e| {
                 FeatureProcessorError::FeatureWriter(format!(
-                    "output {output} rejected by sandbox: {e}"
+                    "sink output {output} rejected by sandbox: {e}"
                 ))
             })?;
             match self.params {