Bump docker/login-action from 4 to 4.5.2

Bumps [docker/login-action](https://github.com/docker/login-action) from 4 to 4.5.2.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v4...v4.5.2)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/close-bugs-bot.yml

@@ -7,7 +7,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@v11
         with:
           close-issue-message: "This issue does not seem to be a problem with the runner application, it concerns the GitHub actions platform more generally. Could you please post your feedback on the [GitHub Community Support Forum](https://github.com/orgs/community/discussions/categories/actions) which is actively monitored. Using the forum ensures that we route your problem to the correct team. 😃"
           exempt-issue-labels: "keep"

.github/workflows/close-features-bot.yml

@@ -7,7 +7,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@v11
         with:
           close-issue-message: "Thank you for your interest in the runner application and taking the time to provide your valuable feedback. We kindly ask you to redirect this feedback to the [GitHub Community Support Forum](https://github.com/orgs/community/discussions/categories/actions) which our team actively monitors and would be a better place to start a discussion for new feature requests in GitHub Actions. For more information on this policy please [read our contribution guidelines](https://github.com/actions/runner#contribute). 😃"
           exempt-issue-labels: "keep"

.github/workflows/docker-publish.yml

@@ -41,7 +41,7 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.5.2
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}

.github/workflows/release.yml

@@ -312,7 +312,7 @@ jobs:
         uses: docker/setup-buildx-action@v4
 
       - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.5.2
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}

.github/workflows/stale-bot.yml

@@ -7,7 +7,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@v11
         with:
           stale-issue-message: "This issue is stale because it has been open 365 days with no activity. Remove stale label or comment or this will be closed in 15 days."
           close-issue-message: "This issue was closed because it has been stalled for 15 days with no activity."

src/Misc/expressionFunc/hashFiles/package.json

@@ -38,13 +38,13 @@
     "@stylistic/eslint-plugin": "^5.10.0",
     "@types/node": "^22.0.0",
     "@typescript-eslint/eslint-plugin": "^8.59.0",
-    "@typescript-eslint/parser": "^8.59.0",
+    "@typescript-eslint/parser": "^8.65.0",
     "@vercel/ncc": "^0.38.3",
     "eslint": "^8.47.0",
-    "eslint-plugin-github": "^4.10.2",
+    "eslint-plugin-github": "^6.1.2",
     "eslint-plugin-prettier": "^5.0.0",
     "husky": "^9.1.7",
-    "lint-staged": "^16.4.0",
+    "lint-staged": "^17.2.0",
     "prettier": "^3.0.3",
     "typescript": "^6.0.3"
   }

src/Runner.Common/ResultsServer.cs

@@ -61,7 +61,7 @@ namespace GitHub.Runner.Common
             if (!string.IsNullOrEmpty(liveConsoleFeedUrl))
             {
                 _liveConsoleFeedUrl = liveConsoleFeedUrl;
-                InitializeWebsocketClient(liveConsoleFeedUrl, token, TimeSpan.Zero, retryConnection: true);
+                InitializeWebsocketClient(liveConsoleFeedUrl, TimeSpan.Zero, retryConnection: true);
             }
         }
 
@@ -164,9 +164,9 @@ namespace GitHub.Runner.Common
             return ValueTask.CompletedTask;
         }
 
-        private void InitializeWebsocketClient(string liveConsoleFeedUrl, string accessToken, TimeSpan delay, bool retryConnection = false)
+        private void InitializeWebsocketClient(string liveConsoleFeedUrl, TimeSpan delay, bool retryConnection = false)
         {
-            if (string.IsNullOrEmpty(accessToken))
+            if (string.IsNullOrEmpty(_token))
             {
                 Trace.Info($"No access token from server");
                 return;
@@ -179,12 +179,7 @@ namespace GitHub.Runner.Common
             }
 
             Trace.Info($"Creating websocket client ..." + liveConsoleFeedUrl);
-            this._websocketClient = new ClientWebSocket();
-            this._websocketClient.Options.SetRequestHeader("Authorization", $"Bearer {accessToken}");
-            var userAgentValues = new List<ProductInfoHeaderValue>();
-            userAgentValues.AddRange(UserAgentUtility.GetDefaultRestUserAgent());
-            userAgentValues.AddRange(HostContext.UserAgents);
-            this._websocketClient.Options.SetRequestHeader("User-Agent", string.Join(" ", userAgentValues.Select(x => x.ToString())));
+            this._websocketClient = CreateWebSocketClient();
 
             // during initialization, retry upto 3 times to setup connection
             this._websocketConnectTask = ConnectWebSocketClient(liveConsoleFeedUrl, delay, retryConnection);
@@ -201,8 +196,15 @@ namespace GitHub.Runner.Common
                 {
                     Trace.Info($"Attempting to start websocket client with delay {delay}.");
                     await Task.Delay(delay);
-                    using var connectTimeoutTokenSource = new CancellationTokenSource(TimeSpan.FromSeconds(30));
-                    await this._websocketClient.ConnectAsync(new Uri(feedStreamUrl), connectTimeoutTokenSource.Token);
+                    using (var connectTimeoutTokenSource = new CancellationTokenSource(TimeSpan.FromSeconds(30)))
+                    {
+                        if (this._websocketClient == null)
+                        {
+                            this._websocketClient = CreateWebSocketClient();
+                        }
+
+                        await this._websocketClient.ConnectAsync(new Uri(feedStreamUrl), connectTimeoutTokenSource.Token);
+                    }
                     Trace.Info($"Successfully started websocket client.");
                     connected = true;
                 }
@@ -211,6 +213,7 @@ namespace GitHub.Runner.Common
                     Trace.Info("Exception caught during websocket client connect, retry connection.");
                     Trace.Error(ex);
                     retries++;
+                    this._websocketClient?.Dispose();
                     this._websocketClient = null;
                     _lastConnectionFailure = DateTime.Now;
                 }
@@ -259,7 +262,7 @@ namespace GitHub.Runner.Common
                             Trace.Info($"Websocket is not open, let's attempt to connect back again with random backoff {delay} ms.");
                             Trace.Verbose(ex.ToString());
                             retries++;
-                            InitializeWebsocketClient(_liveConsoleFeedUrl, _token, delay);
+                            InitializeWebsocketClient(_liveConsoleFeedUrl, delay);
                         }
                     }
                 }
@@ -274,13 +277,24 @@ namespace GitHub.Runner.Common
                 if (_lastConnectionFailure.HasValue && DateTime.Now > _lastConnectionFailure.Value.AddMinutes(10))
                 {
                     // Some minutes passed since we retried last time, try connection again
-                    InitializeWebsocketClient(_liveConsoleFeedUrl, _token, TimeSpan.Zero);
+                    InitializeWebsocketClient(_liveConsoleFeedUrl, TimeSpan.Zero);
                 }
             }
 
             return delivered;
         }
 
+        private ClientWebSocket CreateWebSocketClient()
+        {
+            var client = new ClientWebSocket();
+            client.Options.SetRequestHeader("Authorization", $"Bearer {_token}");
+            var userAgentValues = new List<ProductInfoHeaderValue>();
+            userAgentValues.AddRange(UserAgentUtility.GetDefaultRestUserAgent());
+            userAgentValues.AddRange(HostContext.UserAgents);
+            client.Options.SetRequestHeader("User-Agent", string.Join(" ", userAgentValues.Select(x => x.ToString())));
+            return client;
+        }
+
         private void CloseWebSocket(WebSocketCloseStatus closeStatus, CancellationToken cancellationToken)
         {
             try

src/Runner.Common/VSockSecretNotifier.cs

@@ -0,0 +1,232 @@
+using System;
+using System.Net;
+using System.Net.Sockets;
+using System.Runtime.InteropServices;
+using System.Text;
+using System.Threading;
+using System.Threading.Channels;
+using System.Threading.Tasks;
+using GitHub.DistributedTask.Logging;
+using GitHub.Runner.Sdk;
+using Newtonsoft.Json;
+
+namespace GitHub.Runner.Common
+{
+
+    [ServiceLocator(Default = typeof(VSockSecretNotifier))]
+    public interface IVSockSecretNotifier : IRunnerService, IAsyncDisposable
+    {
+        bool TryStartNotifier();
+
+        void NotifyNewSecret(NewSecretEventArgs newSecret);
+    }
+
+    public sealed class VSockSecretNotifier : RunnerService, IVSockSecretNotifier
+    {
+        private Socket _vsock = null;
+
+        private CancellationTokenSource _cancellationTokenSource = null;
+
+        private Task _secretNotificationTask = null;
+
+        private Channel<byte[]> _channel = Channel.CreateUnbounded<byte[]>(new UnboundedChannelOptions() { SingleReader = true });
+
+        public bool TryStartNotifier()
+        {
+            if (_vsock != null)
+            {
+                Trace.Verbose("VSocket is already connected.");
+                return true;
+            }
+
+            // `GITHUB_ACTIONS_RUNNER_VSOCK_CID_PORT` is expected to be in the format "CID:PORT", e.g. "2:9999".
+            string vsockCidPort = Environment.GetEnvironmentVariable("GITHUB_ACTIONS_RUNNER_VSOCK_CID_PORT");
+            if (string.IsNullOrEmpty(vsockCidPort))
+            {
+                Trace.Verbose("VSocket CID/Port environment variable is not set.");
+                return false;
+            }
+
+            string[] parts = vsockCidPort.Split(':', 2, StringSplitOptions.TrimEntries | StringSplitOptions.RemoveEmptyEntries);
+            if (parts.Length != 2)
+            {
+                Trace.Verbose("VSocket CID/Port environment variable is not in the correct format.");
+                return false;
+            }
+
+            uint cid, port;
+            if (!uint.TryParse(parts[0], out cid) || !uint.TryParse(parts[1], out port))
+            {
+                Trace.Verbose("VSocket CID/Port environment variable contains invalid numbers.");
+                return false;
+            }
+
+            Trace.Info($"Attempting to start VSocket secret notifier with CID: {cid}, Port: {port}.");
+            try
+            {
+                SafeSocketHandle nativeSocket = NativeSocket((int)(AddressFamily)40, (int)SocketType.Stream, 0);
+                if (nativeSocket.IsInvalid)
+                {
+                    int error = Marshal.GetLastPInvokeError();
+                    nativeSocket.Dispose();
+                    throw new SocketException(error);
+                }
+
+                _vsock = new Socket(nativeSocket);
+                _vsock.Connect(new HostVsockEndPoint(cid, port));
+            }
+            catch (Exception ex)
+            {
+                Trace.Error($"Failed to create and connect VSocket: {ex}");
+                _vsock?.Dispose();
+                _vsock = null;
+                return false;
+            }
+
+            _cancellationTokenSource = CancellationTokenSource.CreateLinkedTokenSource(HostContext.RunnerShutdownToken);
+            _secretNotificationTask = ProcessSecretChannel();
+            Trace.Info($"VSocket secret notifier started successfully.");
+            return true;
+        }
+
+        public void NotifyNewSecret(NewSecretEventArgs newSecret)
+        {
+            if (_vsock == null)
+            {
+                Trace.Verbose("VSocket is not connected, skipping secret notification.");
+                return;
+            }
+
+            byte[] payloadBytes = Encoding.UTF8.GetBytes(StringUtil.ConvertToJson(new { RunnerSecrets = newSecret }, Formatting.None));
+            byte[] lengthPrefix = BitConverter.GetBytes(IPAddress.HostToNetworkOrder(payloadBytes.Length));
+            byte[] fullPayload = new byte[lengthPrefix.Length + payloadBytes.Length];
+            Buffer.BlockCopy(lengthPrefix, 0, fullPayload, 0, lengthPrefix.Length);
+            Buffer.BlockCopy(payloadBytes, 0, fullPayload, lengthPrefix.Length, payloadBytes.Length);
+
+            // we don't need to check return since unbounded channel will always accept the item.
+            _channel.Writer.TryWrite(fullPayload);
+        }
+
+        public async ValueTask DisposeAsync()
+        {
+            if (_vsock != null && _secretNotificationTask != null)
+            {
+                _cancellationTokenSource?.Cancel();
+                try
+                {
+                    await _secretNotificationTask;
+                }
+                catch (Exception ex)
+                {
+                    Trace.Error($"Secret notification task finished with error: {ex}");
+                }
+
+                _cancellationTokenSource?.Dispose();
+                _cancellationTokenSource = null;
+                _vsock?.Dispose();
+                _vsock = null;
+            }
+        }
+
+        private async Task ProcessSecretChannel()
+        {
+            try
+            {
+                while (!_cancellationTokenSource.Token.IsCancellationRequested &&
+                        await _channel.Reader.WaitToReadAsync(_cancellationTokenSource.Token))
+                {
+                    while (_channel.Reader.TryRead(out var payload))
+                    {
+                        try
+                        {
+                            // Socket.SendAsync on a stream socket may send fewer bytes than requested,
+                            // so keep sending until the entire payload has been written.
+                            int totalSent = 0;
+                            while (totalSent < payload.Length)
+                            {
+                                int bytesSent = await _vsock.SendAsync(payload.AsMemory(totalSent), SocketFlags.None, _cancellationTokenSource.Token);
+                                if (bytesSent == 0)
+                                {
+                                    throw new SocketException((int)SocketError.ConnectionReset);
+                                }
+
+                                totalSent += bytesSent;
+                            }
+                        }
+                        catch (OperationCanceledException)
+                        {
+                            Trace.Info("Secret notification task was canceled.");
+                        }
+                        catch (Exception ex)
+                        {
+                            Trace.Error($"Failed to notify new secret over VSocket: {ex}");
+                        }
+                    }
+                }
+            }
+            catch (OperationCanceledException)
+            {
+                Trace.Info("Secret notification task was canceled.");
+            }
+            catch (Exception ex)
+            {
+                Trace.Error($"Failed to process secret channel: {ex}");
+            }
+
+            _channel.Writer.TryComplete();
+        }
+
+        [DllImport("libc", SetLastError = true, EntryPoint = "socket")]
+        private static extern SafeSocketHandle NativeSocket(int domain, int type, int protocol);
+    }
+
+    internal sealed class HostVsockEndPoint : EndPoint
+    {
+        private const int SocketAddressSize = 16;
+        private readonly uint _cid;
+        private readonly uint _port;
+
+        public HostVsockEndPoint(uint cid, uint port)
+        {
+            _cid = cid;
+            _port = port;
+        }
+
+        public override AddressFamily AddressFamily => (AddressFamily)40;
+
+        public override SocketAddress Serialize()
+        {
+            SocketAddress socketAddress = new SocketAddress(AddressFamily.Unspecified, SocketAddressSize);
+            // sockaddr_vm layout: family(0-1), reserved1(2-3), port(4-7), cid(8-11)
+            ushort family = (ushort)AddressFamily;
+            socketAddress[0] = (byte)(family & 0xFF);
+            socketAddress[1] = (byte)((family >> 8) & 0xFF);
+            socketAddress[2] = 0;
+            socketAddress[3] = 0;
+            socketAddress[4] = (byte)(_port & 0xFF);
+            socketAddress[5] = (byte)((_port >> 8) & 0xFF);
+            socketAddress[6] = (byte)((_port >> 16) & 0xFF);
+            socketAddress[7] = (byte)((_port >> 24) & 0xFF);
+            socketAddress[8] = (byte)(_cid & 0xFF);
+            socketAddress[9] = (byte)((_cid >> 8) & 0xFF);
+            socketAddress[10] = (byte)((_cid >> 16) & 0xFF);
+            socketAddress[11] = (byte)((_cid >> 24) & 0xFF);
+            return socketAddress;
+        }
+
+        public override EndPoint Create(SocketAddress socketAddress)
+        {
+            uint port = (uint)socketAddress[4]
+                | ((uint)socketAddress[5] << 8)
+                | ((uint)socketAddress[6] << 16)
+                | ((uint)socketAddress[7] << 24);
+
+            uint cid = (uint)socketAddress[8]
+                | ((uint)socketAddress[9] << 8)
+                | ((uint)socketAddress[10] << 16)
+                | ((uint)socketAddress[11] << 24);
+
+            return new HostVsockEndPoint(cid, port);
+        }
+    }
+}

src/Runner.Worker/Dap/DapDebugger.cs

@@ -1026,7 +1026,9 @@ namespace GitHub.Runner.Worker.Dap
             {
                 if (!string.IsNullOrEmpty(debuggerConfig.WelcomeMessage))
                 {
-                    SendOutput("console", debuggerConfig.WelcomeMessage);
+                    // The welcome message is server-supplied and never rendered verbatim:
+                    // mask secrets and strip control characters before it reaches the console.
+                    SendOutput("console", SanitizeConsoleText(MaskUserVisibleText(debuggerConfig.WelcomeMessage)));
                     Trace.Info("Sent custom welcome message");
                 }
                 else
@@ -1772,6 +1774,30 @@ namespace GitHub.Runner.Worker.Dap
             return HostContext?.SecretMasker?.MaskSecrets(value) ?? value;
         }
 
+        /// <summary>
+        /// Removes C0/C1 control characters (except tab, carriage return and line feed) so
+        /// server-supplied text cannot inject ANSI escape sequences or terminal control codes
+        /// into the DAP console.
+        /// </summary>
+        internal static string SanitizeConsoleText(string value)
+        {
+            if (string.IsNullOrEmpty(value))
+            {
+                return value ?? string.Empty;
+            }
+
+            var builder = new StringBuilder(value.Length);
+            foreach (var character in value)
+            {
+                if (!char.IsControl(character) || character == '\t' || character == '\r' || character == '\n')
+                {
+                    builder.Append(character);
+                }
+            }
+
+            return builder.ToString();
+        }
+
         /// <summary>
         /// Creates a DAP response with common fields pre-populated.
         /// </summary>

src/Runner.Worker/Dap/DebuggerConfig.cs

@@ -36,6 +36,11 @@ namespace GitHub.Runner.Worker.Dap
         /// Optional welcome message content for the debugger console. Only used when
         /// <see cref="OverrideWelcomeMessage"/> is true.
         /// </summary>
+        /// <remarks>
+        /// Server-supplied and treated as untrusted: it is masked with the runner's
+        /// secret masker and stripped of control characters before being written to
+        /// the debugger console.
+        /// </remarks>
         public string WelcomeMessage { get; }
 
         /// <summary>Whether the tunnel configuration is complete and valid.</summary>

src/Runner.Worker/Runner.Worker.csproj

@@ -23,7 +23,7 @@
     <PackageReference Include="System.ServiceProcess.ServiceController" Version="10.0.3" />
     <PackageReference Include="System.Threading.Channels" Version="10.0.3" />
     <PackageReference Include="YamlDotNet.Signed" Version="5.3.0" />
-    <PackageReference Include="Microsoft.DevTunnels.Connections" Version="1.3.48" />
+    <PackageReference Include="Microsoft.DevTunnels.Connections" Version="1.3.50" />
   </ItemGroup>
 
   <ItemGroup>

src/Runner.Worker/Worker.cs

@@ -1,15 +1,14 @@
-using GitHub.DistributedTask.WebApi;
-using Pipelines = GitHub.DistributedTask.Pipelines;
-using GitHub.Runner.Common.Util;
-using Newtonsoft.Json;
-using System;
+using System;
 using System.Collections.Generic;
+using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
-using GitHub.Services.WebApi;
+using GitHub.DistributedTask.WebApi;
 using GitHub.Runner.Common;
+using GitHub.Runner.Common.Util;
 using GitHub.Runner.Sdk;
-using System.Text;
+using Newtonsoft.Json;
+using Pipelines = GitHub.DistributedTask.Pipelines;
 
 namespace GitHub.Runner.Worker
 {
@@ -46,6 +45,7 @@ namespace GitHub.Runner.Worker
                 var jobRunner = HostContext.CreateService<IJobRunner>();
                 var terminal = HostContext.GetService<ITerminal>();
 
+                await using (var secretNotifier = HostContext.GetService<IVSockSecretNotifier>())
                 using (var channel = HostContext.CreateService<IProcessChannel>())
                 using (var jobRequestCancellationToken = CancellationTokenSource.CreateLinkedTokenSource(HostContext.RunnerShutdownToken))
                 using (var channelTokenSource = new CancellationTokenSource())
@@ -86,6 +86,14 @@ namespace GitHub.Runner.Worker
                     HostContext.WritePerfCounter($"WorkerJobMessageReceived_{jobMessage.RequestId.ToString()}");
 
                     // Initialize the secret masker and set the thread culture.
+                    if (Constants.Runner.Platform == Constants.OSPlatform.Linux &&
+                        secretNotifier.TryStartNotifier())
+                    {
+                        HostContext.SecretMasker.NewSecretAdded += (sender, e) =>
+                        {
+                            secretNotifier.NotifyNewSecret(e);
+                        };
+                    }
                     InitializeSecretMasker(jobMessage);
                     SetCulture(jobMessage);
 

src/Sdk/DTLogging/Logging/ISecretMasker.cs

@@ -1,5 +1,7 @@
 using System;
+using System.Collections.Generic;
 using System.ComponentModel;
+using System.Runtime.Serialization;
 
 namespace GitHub.DistributedTask.Logging
 {
@@ -11,5 +13,41 @@ namespace GitHub.DistributedTask.Logging
         void AddValueEncoder(ValueEncoder encoder);
         ISecretMasker Clone();
         String MaskSecrets(String input);
+        public event EventHandler<NewSecretEventArgs> NewSecretAdded;
+    }
+
+    public abstract class NewSecretEventArgs : EventArgs
+    {
+        public abstract String Type { get; }
+    }
+
+    [DataContract]
+    public sealed class NewRegexSecretEventArgs : NewSecretEventArgs
+    {
+        [DataMember]
+        public override String Type => "regex";
+
+        public NewRegexSecretEventArgs(String pattern)
+        {
+            Pattern = pattern;
+        }
+
+        [DataMember]
+        public String Pattern { get; private set; }
+    }
+
+    [DataContract]
+    public sealed class NewVariableSecretEventArgs : NewSecretEventArgs
+    {
+        [DataMember]
+        public override String Type => "variable";
+
+        public NewVariableSecretEventArgs(List<string> values)
+        {
+            Values.AddRange(values);
+        }
+
+        [DataMember]
+        public List<string> Values { get; private set; } = new List<string>();
     }
 }

src/Sdk/DTLogging/Logging/SecretMasker.cs

@@ -10,6 +10,8 @@ namespace GitHub.DistributedTask.Logging
     [EditorBrowsable(EditorBrowsableState.Never)]
     public sealed class SecretMasker : ISecretMasker, IDisposable
     {
+        public event EventHandler<NewSecretEventArgs> NewSecretAdded;
+
         public SecretMasker()
         {
             m_originalValueSecrets = new HashSet<ValueSecret>();
@@ -66,6 +68,8 @@ namespace GitHub.DistributedTask.Logging
                     m_lock.ExitWriteLock();
                 }
             }
+
+            NewSecretAdded?.Invoke(this, new NewRegexSecretEventArgs(pattern));
         }
 
         /// <summary>
@@ -133,6 +137,9 @@ namespace GitHub.DistributedTask.Logging
                     m_lock.ExitWriteLock();
                 }
             }
+
+            // valueSecrets contains all the values run through the encoders.
+            NewSecretAdded?.Invoke(this, new NewVariableSecretEventArgs(valueSecrets.Select(x => x.m_value).ToList()));
         }
 
         /// <summary>

src/Sdk/DTPipelines/Pipelines/AgentJobRequestMessage.cs

@@ -271,7 +271,7 @@ namespace GitHub.DistributedTask.Pipelines
         /// Optional welcome message shown in the debugger console when a client connects.
         /// Only used when the <c>actions_runner_override_debugger_welcome_message</c>
         /// feature flag is set to <c>true</c> in the job variables. With the flag set,
-        /// a non-empty value is shown as-is and a null or empty value suppresses the
+        /// a non-empty value is shown and a null or empty value suppresses the
         /// default welcome message. When the flag is not set, the runner shows its
         /// built-in help text and this field is ignored.
         /// </summary>

src/Sdk/Sdk.csproj

@@ -23,14 +23,14 @@
         <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
         <PackageReference Include="Microsoft.AspNet.WebApi.Client" Version="6.0.0" />
         <PackageReference Include="System.Security.Cryptography.Cng" Version="5.0.0" />
-        <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.7" />
+        <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.10" />
         <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="10.0.3" />
         <PackageReference Include="Minimatch" Version="2.0.0" />
         <PackageReference Include="YamlDotNet.Signed" Version="5.3.0" />
         <PackageReference Include="System.Net.Http" Version="4.3.4" />
         <PackageReference Include="System.Text.RegularExpressions" Version="4.3.1" />
         <PackageReference Include="System.Private.Uri" Version="4.3.2" />
-        <PackageReference Include="System.Formats.Asn1" Version="10.0.7" />
+        <PackageReference Include="System.Formats.Asn1" Version="10.0.10" />
     </ItemGroup>
 
     <ItemGroup>

src/Test/L0/Worker/DapDebuggerL0.cs

@@ -1422,6 +1422,96 @@ namespace GitHub.Runner.Common.Tests.Worker
             }
         }
 
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public async Task WelcomeMessageMasksSecrets()
+        {
+            using (var hc = CreateTestContext())
+            {
+                hc.SecretMasker.AddValue("super-secret-token");
+
+                var port = GetFreePort();
+                using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+                var jobContext = CreateJobContextWithTunnel(cts.Token, port,
+                    overrideWelcomeMessage: true,
+                    welcomeMessage: "Welcome! Token: super-secret-token");
+                await _debugger.StartAsync(jobContext.Object);
+
+                using var client = await ConnectClientAsync(port);
+                var stream = client.GetStream();
+
+                await SendRequestAsync(stream, new Request
+                {
+                    Seq = 1,
+                    Type = "request",
+                    Command = "configurationDone"
+                });
+
+                var configDoneResponse = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                Assert.Contains("\"command\":\"configurationDone\"", configDoneResponse);
+
+                var welcomeMsg = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                Assert.Contains("\"event\":\"output\"", welcomeMsg);
+                Assert.DoesNotContain("super-secret-token", welcomeMsg);
+                Assert.Contains("***", welcomeMsg);
+
+                await _debugger.StopAsync();
+            }
+        }
+
+        [Fact]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        public async Task WelcomeMessageStripsControlCharacters()
+        {
+            using (CreateTestContext())
+            {
+                var port = GetFreePort();
+                using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+                var jobContext = CreateJobContextWithTunnel(cts.Token, port,
+                    overrideWelcomeMessage: true,
+                    welcomeMessage: "Wel\u001b[31mcome\u0007\u0000\u009bhere\nnext\tline");
+                await _debugger.StartAsync(jobContext.Object);
+
+                using var client = await ConnectClientAsync(port);
+                var stream = client.GetStream();
+
+                await SendRequestAsync(stream, new Request
+                {
+                    Seq = 1,
+                    Type = "request",
+                    Command = "configurationDone"
+                });
+
+                var configDoneResponse = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                Assert.Contains("\"command\":\"configurationDone\"", configDoneResponse);
+
+                var welcomeMsg = await ReadDapMessageAsync(stream, TimeSpan.FromSeconds(5));
+                Assert.Contains("\"event\":\"output\"", welcomeMsg);
+
+                var output = JObject.Parse(welcomeMsg)["body"]["output"].ToString();
+                Assert.Equal("Wel[31mcomehere\nnext\tline", output);
+
+                await _debugger.StopAsync();
+            }
+        }
+
+        [Theory]
+        [Trait("Level", "L0")]
+        [Trait("Category", "Worker")]
+        [InlineData(null, "")]
+        [InlineData("", "")]
+        [InlineData("plain text", "plain text")]
+        [InlineData("keep\r\nnewlines\tand tabs", "keep\r\nnewlines\tand tabs")]
+        [InlineData("esc\u001bape", "escape")]
+        [InlineData("bell\u0007null\u0000del\u007f", "bellnulldel")]
+        [InlineData("c1\u0080\u009fchars", "c1chars")]
+        public void SanitizeConsoleTextRemovesControlCharacters(string input, string expected)
+        {
+            Assert.Equal(expected, DapDebugger.SanitizeConsoleText(input));
+        }
+
         [Fact]
         [Trait("Level", "L0")]
         [Trait("Category", "Worker")]

src/Test/L0/Worker/WorkerL0.cs

@@ -16,11 +16,13 @@ namespace GitHub.Runner.Common.Tests.Worker
     {
         private Mock<IProcessChannel> _processChannel;
         private Mock<IJobRunner> _jobRunner;
+        private Mock<IVSockSecretNotifier> _vsockSecretNotifier;
 
         public WorkerL0()
         {
             _processChannel = new Mock<IProcessChannel>();
             _jobRunner = new Mock<IJobRunner>();
+            _vsockSecretNotifier = new Mock<IVSockSecretNotifier>();
         }
 
         private Pipelines.AgentJobRequestMessage CreateJobRequestMessage(string jobName)
@@ -88,6 +90,7 @@ namespace GitHub.Runner.Common.Tests.Worker
                 var worker = new GitHub.Runner.Worker.Worker();
                 hc.EnqueueInstance<IProcessChannel>(_processChannel.Object);
                 hc.EnqueueInstance<IJobRunner>(_jobRunner.Object);
+                hc.SetSingleton<IVSockSecretNotifier>(_vsockSecretNotifier.Object);
                 worker.Initialize(hc);
                 var jobMessage = CreateJobRequestMessage("job1");
                 var arWorkerMessages = new WorkerMessage[]
@@ -139,6 +142,7 @@ namespace GitHub.Runner.Common.Tests.Worker
                 var worker = new GitHub.Runner.Worker.Worker();
                 hc.EnqueueInstance<IProcessChannel>(_processChannel.Object);
                 hc.EnqueueInstance<IJobRunner>(_jobRunner.Object);
+                hc.SetSingleton<IVSockSecretNotifier>(_vsockSecretNotifier.Object);
                 worker.Initialize(hc);
                 var jobMessage = CreateJobRequestMessage("job1");
                 var cancelMessage = CreateJobCancelMessage(jobMessage.JobId);