v2.1.6+Inline Scripting tasks

An Inline Scripting task is a plug-in task type included in the HCL Universal Orchestrator installation that enables you to run short JavaScript or Python scripts inline within a workflow, with structured inputs, controlled outputs, and sandboxed run.

Overview

Inline Scripting tasks are designed for short, self-contained logic — data shaping, decision points, and lightweight API calls — embedded directly in a workflow without building or deploying a dedicated plug-in. They are not a replacement for a full Node.js or Python environment: scripts that require external package installation, local file access, or complex library dependencies are outside the scope of this task type.

An Inline Scripting task runs on the agent in an isolated runtime. It receives structured input values, runs the script, captures all console output in the task log, and publishes the script result as output properties for downstream tasks in the workflow.

Language actions

An Inline Scripting task supports two language actions. Each action uses a dedicated sandboxed runtime and provides an HTTP interface for outbound calls:

Action Runtime HTTP interface
Run JavaScript GraalJS (sandboxed) fetch() (Promise-based)
Run Python GraalVM Python (sandboxed) requests library interface
Script inputs and outputs

At runtime, the engine injects an inputs object (JavaScript) or dict (Python) populated from the JSON object you define in the task parameters. The script reads input values by key name. The inputs object is read-only.

To surface results for downstream tasks, use one of two approaches:

  • Explicit output properties: Assign values to the outputs object. Each key you assign becomes a named output property (for example, result.key) accessible to successor tasks. When any outputs key is set, the last-statement value is ignored.
  • Last-statement result: When no outputs keys are set, the value of the final statement is captured and published as result.result.

Console output (console.log, console.info, console.warn, and console.error) is written to the task log in real time as each call fires during the script run.

Sandbox and security

Inline Scripting tasks run in a secure run environment with the following constraints:

  • Local filesystem access is blocked. Scripts cannot read or write files on the agent host.
  • Outbound HTTP(S) calls are blocked by default. To enable outbound calls, configure an allowedHosts list at the connection or agent level. Hosts on the blockedHosts list are always denied regardless of the allowlist.
  • Run time is bounded by a configurable timeout (default 60 seconds, maximum 600 seconds).
  • Memory use is bounded by a configurable ceiling (default 256 MB, maximum 1024 MB).
  • Credential values passed through input parameters are never echoed in task logs.