feat: added require to load scripts using CommonJs

[JulienLeal]

Proposed changes

Enabled CommonJS require support in GraalJS engine for Maestro flows

• Added GraalJS context configuration with js.commonjs-require and js.commonjs-require-cwd options
• Implemented module resolution relative to the executed YAML file's directory
• Set MAESTRO_YAML_DIR environment variable automatically for script context
• Added validation for module directory existence
• Modified RunScriptCommand to propagate YAML file location context

Testing

Added integration test:

• ✅ Case 121 - CommonJS require functionality
  • Verifies successful module resolution from YAML file directory
  • Tests cross-file require() with JSON serialization
  • Validates console output logging

Manual verification:

1. Tested multi-level directory structures
2. Verified relative path resolution (./lib/utils.js)
3. Checked error handling for missing modules
4. Validated Windows/Linux path compatibility

Issues fixed

• Fixes lack of Node-style module resolution in Maestro JS scripts Importing JS modules (both CJS and ESM) doesn't work in GraalJS #1637 (example)
• Eliminates need for absolute paths in require() statements
• Ensures consistent module resolution base across nested flows

[Fishbowler]

I'm trying to work out how we can support this both in Maestro CLI, but also then in the Maestro hosted infrastructure, but without introducing a security risk through path traversal. I can't see that js.commonjs-require-cwd and related options give any security guarantees.

[JulienLeal]

Hi @Fishbowler I'll take a look on it on the next weekend. I was on vacations, sorry my delay

[Angelk90]

@JulienLeal : Is there anything new?

[JulienLeal]

@Angelk90 yes, I'll give update this week

[JulienLeal]

Hi @Fishbowler, how are you?

I believe the best way to address this security concern is to implement the Polyglot Sandbox policies described here:
https://docs.oracle.com/en/graalvm/jdk/22/docs/security-guide/polyglot-sandbox/#sandbox-policies

Unfortunately, sandbox policies require GraalVM 23.0 (see https://www.graalvm.org/sdk/javadoc/org/graalvm/polyglot/SandboxPolicy.html), so upgrading will likely take extra time to address any new compatibility concerns.

For now, I’ve provided a custom FileSystem implementation that effectively guards against path traversal.