@aragon-agent/core 0.1.3

package/dist/sandbox/console-capture.js

@@ -0,0 +1,56 @@
+/**
+ * CodeAct Sandbox — Console Capture
+ *
+ * Captures console.log/warn/error/info calls from inside the isolated-vm
+ * sandbox and buffers them on the host side. Uses synchronous ivm.Reference
+ * callbacks (applySync) so console calls behave naturally in sandbox code.
+ */
+import ivm from 'isolated-vm';
+/** Maximum number of console entries to buffer before discarding oldest. */
+const MAX_BUFFER_SIZE = 1000;
+/**
+ * ConsoleCapture intercepts console method calls inside an isolated-vm
+ * Context and stores them as ConsoleEntry records on the host.
+ */
+export class ConsoleCapture {
+    entries = [];
+    /**
+     * Inject console overrides into the given isolated-vm context.
+     *
+     * Replaces globalThis.console with an object whose log/warn/error/info
+     * methods forward arguments (stringified) to the host via a synchronous
+     * ivm.Reference callback.
+     */
+    async inject(context) {
+        const captureRef = new ivm.Reference((level, message) => {
+            const entry = {
+                level: level,
+                args: [message],
+                timestamp: Date.now(),
+            };
+            if (this.entries.length >= MAX_BUFFER_SIZE) {
+                // Discard the oldest entry to stay within the buffer limit.
+                this.entries.shift();
+            }
+            this.entries.push(entry);
+        });
+        await context.evalClosure(`
+      const _capture = $0;
+      globalThis.console = {
+        log:   (...args) => _capture.applySync(undefined, ['log',   args.map(String).join(' ')]),
+        warn:  (...args) => _capture.applySync(undefined, ['warn',  args.map(String).join(' ')]),
+        error: (...args) => _capture.applySync(undefined, ['error', args.map(String).join(' ')]),
+        info:  (...args) => _capture.applySync(undefined, ['info',  args.map(String).join(' ')]),
+      };
+      `, [captureRef], { arguments: { reference: true } });
+    }
+    /**
+     * Return all captured console entries and clear the internal buffer.
+     * Typically called after each execute() to collect output.
+     */
+    drain() {
+        const result = this.entries;
+        this.entries = [];
+        return result;
+    }
+}

package/dist/sandbox/http-bridge.d.ts

@@ -0,0 +1,47 @@
+/**
+ * CodeAct Sandbox — HTTP Bridge
+ *
+ * Provides a domain-whitelisted `fetch` function inside the isolated-vm
+ * sandbox. All HTTP requests are proxied through the host process using
+ * Node.js native fetch, with configurable timeout and response size limits.
+ */
+import ivm from 'isolated-vm';
+/** Configuration for the HTTP bridge. */
+export interface HttpBridgeConfig {
+    /** Allowed hostnames. Requests to unlisted hosts are rejected. */
+    allowedHosts: string[];
+    /** Per-request timeout in milliseconds. Default: 10_000. */
+    timeout?: number;
+    /** Maximum response body size in bytes. Default: 1_048_576 (1 MB). */
+    maxResponseSize?: number;
+}
+/**
+ * HttpBridge injects a `globalThis.fetch` function into the sandbox that
+ * proxies requests through the host with domain whitelisting.
+ */
+export declare class HttpBridge {
+    private readonly allowedHosts;
+    private readonly timeout;
+    private readonly maxResponseSize;
+    constructor(config: HttpBridgeConfig);
+    /**
+     * Inject the `fetch` global async function into the given context.
+     * Sandbox signature: `async function fetch(url, options?) => { status, statusText, headers, body }`
+     */
+    inject(context: ivm.Context): Promise<void>;
+    /** Allowed URL protocols. Blocks file://, data://, etc. */
+    private static readonly ALLOWED_PROTOCOLS;
+    /**
+     * Extract hostname from a URL string and validate protocol.
+     * Throws if the URL is malformed or uses a disallowed protocol.
+     */
+    private extractHostname;
+    /**
+     * Read the response body as text, enforcing the maximum size limit.
+     * If the body exceeds the limit, it is truncated and a warning appended.
+     *
+     * NOTE: We always stream-read to enforce the limit, regardless of
+     * Content-Length header (which can be spoofed by the remote server).
+     */
+    private readBodyWithLimit;
+}

package/dist/sandbox/http-bridge.js

@@ -0,0 +1,143 @@
+/**
+ * CodeAct Sandbox — HTTP Bridge
+ *
+ * Provides a domain-whitelisted `fetch` function inside the isolated-vm
+ * sandbox. All HTTP requests are proxied through the host process using
+ * Node.js native fetch, with configurable timeout and response size limits.
+ */
+import ivm from 'isolated-vm';
+/** Default request timeout (10 seconds). */
+const DEFAULT_TIMEOUT = 10_000;
+/** Default maximum response body size (1 MB). */
+const DEFAULT_MAX_RESPONSE_SIZE = 1_048_576;
+/**
+ * HttpBridge injects a `globalThis.fetch` function into the sandbox that
+ * proxies requests through the host with domain whitelisting.
+ */
+export class HttpBridge {
+    allowedHosts;
+    timeout;
+    maxResponseSize;
+    constructor(config) {
+        this.allowedHosts = new Set(config.allowedHosts.map((h) => h.toLowerCase()));
+        this.timeout = config.timeout ?? DEFAULT_TIMEOUT;
+        this.maxResponseSize = config.maxResponseSize ?? DEFAULT_MAX_RESPONSE_SIZE;
+    }
+    /**
+     * Inject the `fetch` global async function into the given context.
+     * Sandbox signature: `async function fetch(url, options?) => { status, statusText, headers, body }`
+     */
+    async inject(context) {
+        const fetchRef = new ivm.Reference(async (requestJson) => {
+            const { url, options } = JSON.parse(requestJson);
+            // --- Domain whitelist check ---
+            const hostname = this.extractHostname(url);
+            if (!this.allowedHosts.has(hostname.toLowerCase())) {
+                throw new Error(`HTTP request blocked: hostname "${hostname}" is not in the allowed hosts list`);
+            }
+            // --- Execute host-side fetch with timeout ---
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), this.timeout);
+            try {
+                const response = await fetch(url, {
+                    method: options?.method ?? 'GET',
+                    headers: options?.headers,
+                    body: options?.body,
+                    signal: controller.signal,
+                    // SECURITY: Do not follow redirects automatically.
+                    // A whitelisted domain could redirect to an internal service (SSRF).
+                    redirect: 'manual',
+                });
+                // Read body with size limit enforcement.
+                const body = await this.readBodyWithLimit(response);
+                // Collect response headers into a plain object.
+                const headers = {};
+                response.headers.forEach((value, key) => {
+                    headers[key] = value;
+                });
+                const result = {
+                    status: response.status,
+                    statusText: response.statusText,
+                    headers,
+                    body,
+                };
+                return JSON.stringify(result);
+            }
+            catch (err) {
+                if (err instanceof DOMException && err.name === 'AbortError') {
+                    throw new Error(`HTTP request timed out after ${this.timeout}ms`);
+                }
+                throw err;
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        });
+        // Register fetch in the sandbox. The sandbox function serializes
+        // arguments to JSON, sends to host, and deserializes the response.
+        await context.evalClosure(`globalThis.fetch = async function(url, options) {
+        const requestJson = JSON.stringify({ url, options });
+        const responseJson = await $0.apply(undefined, [requestJson], { result: { promise: true } });
+        return JSON.parse(responseJson);
+      }`, [fetchRef], { arguments: { reference: true } });
+    }
+    // ---------------------------------------------------------------------------
+    // Private helpers
+    // ---------------------------------------------------------------------------
+    /** Allowed URL protocols. Blocks file://, data://, etc. */
+    static ALLOWED_PROTOCOLS = new Set(['http:', 'https:']);
+    /**
+     * Extract hostname from a URL string and validate protocol.
+     * Throws if the URL is malformed or uses a disallowed protocol.
+     */
+    extractHostname(url) {
+        let parsed;
+        try {
+            parsed = new URL(url);
+        }
+        catch {
+            throw new Error(`Invalid URL: "${url}"`);
+        }
+        // SECURITY: Only allow http/https to prevent file://, data://, etc.
+        if (!HttpBridge.ALLOWED_PROTOCOLS.has(parsed.protocol)) {
+            throw new Error(`Blocked URL protocol "${parsed.protocol}" — only http: and https: are allowed`);
+        }
+        return parsed.hostname;
+    }
+    /**
+     * Read the response body as text, enforcing the maximum size limit.
+     * If the body exceeds the limit, it is truncated and a warning appended.
+     *
+     * NOTE: We always stream-read to enforce the limit, regardless of
+     * Content-Length header (which can be spoofed by the remote server).
+     */
+    async readBodyWithLimit(response) {
+        // Stream-read with size enforcement.
+        const reader = response.body?.getReader();
+        if (!reader) {
+            return '';
+        }
+        const decoder = new TextDecoder();
+        const chunks = [];
+        let totalBytes = 0;
+        try {
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                totalBytes += value.byteLength;
+                if (totalBytes > this.maxResponseSize) {
+                    // Decode what we have so far and truncate.
+                    chunks.push(decoder.decode(value, { stream: false }));
+                    chunks.push(`\n\n[Response truncated at ${this.maxResponseSize} bytes]`);
+                    break;
+                }
+                chunks.push(decoder.decode(value, { stream: true }));
+            }
+        }
+        finally {
+            reader.releaseLock();
+        }
+        return chunks.join('');
+    }
+}

package/dist/sandbox/isolated-vm-sandbox.d.ts

@@ -0,0 +1,50 @@
+/**
+ * CodeAct Sandbox — IsolatedVmSandbox
+ *
+ * Primary implementation of the CodeActSandbox interface using the
+ * `isolated-vm` package. Provides a memory-limited, time-limited V8
+ * Isolate with bridged tool access, console capture, and HTTP fetch.
+ *
+ * Key design decisions:
+ *   - Lazy initialization: the V8 Isolate is not created until first execute().
+ *   - Variable persistence: the same Context is reused across execute() calls
+ *     so variables defined in one call are available in subsequent calls.
+ *   - reset() destroys the Context and re-creates it (clears all variables).
+ *   - dispose() releases the Isolate entirely.
+ */
+import type { CodeActSandbox, ExecuteOptions, ExecuteResult, SandboxConfig } from './types.js';
+/**
+ * IsolatedVmSandbox executes LLM-generated JavaScript code in an isolated
+ * V8 environment with injected tool bridges, console capture, and HTTP access.
+ */
+export declare class IsolatedVmSandbox implements CodeActSandbox {
+    private isolate;
+    private context;
+    private disposed;
+    private readonly memoryLimitMB;
+    private readonly defaultTimeout;
+    private readonly tools;
+    private readonly allowedHosts;
+    private readonly globals;
+    private consoleCapture;
+    private toolBridge;
+    private httpBridge;
+    constructor(config?: SandboxConfig);
+    get isDisposed(): boolean;
+    execute(code: string, options?: ExecuteOptions): Promise<ExecuteResult>;
+    reset(): Promise<void>;
+    dispose(): void;
+    /** Full lazy initialization: create Isolate, Context, and inject bridges. */
+    private initialize;
+    /**
+     * Create a new Context within the existing Isolate and inject all
+     * bridges (console, tools, HTTP, globals).
+     */
+    private createContextAndInjectBridges;
+    /** Validate that a name is a safe JavaScript identifier. */
+    private static validateIdentifier;
+    /** Inject user-provided global variables into the sandbox context. */
+    private injectGlobals;
+    /** Throw immediately if the sandbox has been disposed. */
+    private assertNotDisposed;
+}

package/dist/sandbox/isolated-vm-sandbox.js

@@ -0,0 +1,226 @@
+/**
+ * CodeAct Sandbox — IsolatedVmSandbox
+ *
+ * Primary implementation of the CodeActSandbox interface using the
+ * `isolated-vm` package. Provides a memory-limited, time-limited V8
+ * Isolate with bridged tool access, console capture, and HTTP fetch.
+ *
+ * Key design decisions:
+ *   - Lazy initialization: the V8 Isolate is not created until first execute().
+ *   - Variable persistence: the same Context is reused across execute() calls
+ *     so variables defined in one call are available in subsequent calls.
+ *   - reset() destroys the Context and re-creates it (clears all variables).
+ *   - dispose() releases the Isolate entirely.
+ */
+import ivm from 'isolated-vm';
+import { ConsoleCapture } from './console-capture.js';
+import { ToolBridge } from './tool-bridge.js';
+import { HttpBridge } from './http-bridge.js';
+/** Default V8 Isolate memory limit (megabytes). */
+const DEFAULT_MEMORY_LIMIT_MB = 128;
+/** Default per-execution timeout (milliseconds). */
+const DEFAULT_TIMEOUT_MS = 30_000;
+/**
+ * IsolatedVmSandbox executes LLM-generated JavaScript code in an isolated
+ * V8 environment with injected tool bridges, console capture, and HTTP access.
+ */
+export class IsolatedVmSandbox {
+    isolate = null;
+    context = null;
+    disposed = false;
+    memoryLimitMB;
+    defaultTimeout;
+    tools;
+    allowedHosts;
+    globals;
+    // Bridge instances — recreated on reset().
+    consoleCapture = null;
+    toolBridge = null;
+    httpBridge = null;
+    constructor(config = {}) {
+        this.memoryLimitMB = config.memoryLimitMB ?? DEFAULT_MEMORY_LIMIT_MB;
+        this.defaultTimeout = config.defaultTimeout ?? DEFAULT_TIMEOUT_MS;
+        this.tools = config.tools ?? [];
+        this.allowedHosts = config.allowedHosts ?? [];
+        this.globals = config.globals ?? {};
+    }
+    // ---------------------------------------------------------------------------
+    // CodeActSandbox interface
+    // ---------------------------------------------------------------------------
+    get isDisposed() {
+        return this.disposed;
+    }
+    async execute(code, options) {
+        this.assertNotDisposed();
+        // Lazy initialization on first execute().
+        if (!this.isolate) {
+            await this.initialize();
+        }
+        // Honor AbortSignal if already aborted.
+        if (options?.signal?.aborted) {
+            return {
+                consoleOutput: [],
+                error: { name: 'AbortError', message: 'Execution aborted before start' },
+                duration: 0,
+                toolCalls: [],
+            };
+        }
+        const timeout = options?.timeout ?? this.defaultTimeout;
+        const startTime = Date.now();
+        // Clear per-execution state.
+        this.toolBridge.clearToolCalls();
+        // Wrap user code in an async IIFE for top-level await support.
+        const wrappedCode = wrapCode(code);
+        try {
+            // Use context.eval with promise:true to support async code.
+            const rawResult = await this.context.eval(wrappedCode, {
+                timeout,
+                promise: true,
+            });
+            // Serialize the return value. Handle non-serializable values gracefully.
+            let returnValue;
+            if (rawResult !== undefined && rawResult !== null) {
+                try {
+                    returnValue = typeof rawResult === 'string'
+                        ? rawResult
+                        : JSON.stringify(rawResult);
+                }
+                catch {
+                    returnValue = String(rawResult);
+                }
+            }
+            return {
+                returnValue,
+                consoleOutput: this.consoleCapture.drain(),
+                duration: Date.now() - startTime,
+                toolCalls: this.toolBridge.getToolCalls(),
+            };
+        }
+        catch (err) {
+            const errorInfo = extractErrorInfo(err);
+            return {
+                consoleOutput: this.consoleCapture.drain(),
+                error: errorInfo,
+                duration: Date.now() - startTime,
+                toolCalls: this.toolBridge.getToolCalls(),
+            };
+        }
+    }
+    async reset() {
+        this.assertNotDisposed();
+        if (!this.isolate) {
+            // Not yet initialized — nothing to reset.
+            return;
+        }
+        // Release the current context.
+        if (this.context) {
+            this.context.release();
+            this.context = null;
+        }
+        // Create a fresh context and re-inject all bridges.
+        await this.createContextAndInjectBridges();
+    }
+    dispose() {
+        if (this.disposed)
+            return;
+        this.disposed = true;
+        if (this.context) {
+            this.context.release();
+            this.context = null;
+        }
+        if (this.isolate) {
+            this.isolate.dispose();
+            this.isolate = null;
+        }
+        this.consoleCapture = null;
+        this.toolBridge = null;
+        this.httpBridge = null;
+    }
+    // ---------------------------------------------------------------------------
+    // Private — Initialization
+    // ---------------------------------------------------------------------------
+    /** Full lazy initialization: create Isolate, Context, and inject bridges. */
+    async initialize() {
+        this.isolate = new ivm.Isolate({ memoryLimit: this.memoryLimitMB });
+        await this.createContextAndInjectBridges();
+    }
+    /**
+     * Create a new Context within the existing Isolate and inject all
+     * bridges (console, tools, HTTP, globals).
+     */
+    async createContextAndInjectBridges() {
+        this.context = await this.isolate.createContext();
+        // --- Console capture ---
+        this.consoleCapture = new ConsoleCapture();
+        await this.consoleCapture.inject(this.context);
+        // --- Tool bridge ---
+        this.toolBridge = new ToolBridge(this.tools);
+        await this.toolBridge.injectAll(this.context);
+        // --- HTTP bridge ---
+        this.httpBridge = new HttpBridge({ allowedHosts: this.allowedHosts });
+        await this.httpBridge.inject(this.context);
+        // --- Pre-injected globals ---
+        await this.injectGlobals();
+    }
+    /** Validate that a name is a safe JavaScript identifier. */
+    static validateIdentifier(name) {
+        if (!/^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(name)) {
+            throw new Error(`Invalid global variable name "${name}": must be a valid JS identifier`);
+        }
+    }
+    /** Inject user-provided global variables into the sandbox context. */
+    async injectGlobals() {
+        const jail = this.context.global;
+        for (const [key, value] of Object.entries(this.globals)) {
+            // SECURITY: Validate key is a safe identifier before interpolating into eval'd code.
+            IsolatedVmSandbox.validateIdentifier(key);
+            // Only primitive values and JSON-serializable objects can be transferred.
+            if (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean') {
+                await jail.set(key, value);
+            }
+            else if (value === null || value === undefined) {
+                await jail.set(key, value ?? null);
+            }
+            else {
+                // Serialize complex values as JSON and parse inside sandbox.
+                const json = JSON.stringify(value);
+                await this.context.eval(`globalThis.${key} = ${json};`);
+            }
+        }
+    }
+    // ---------------------------------------------------------------------------
+    // Private — Helpers
+    // ---------------------------------------------------------------------------
+    /** Throw immediately if the sandbox has been disposed. */
+    assertNotDisposed() {
+        if (this.disposed) {
+            throw new Error('Cannot use a disposed CodeActSandbox');
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Module-level helpers
+// ---------------------------------------------------------------------------
+/**
+ * Wrap user code in an async IIFE so top-level `await` and `return` work.
+ */
+function wrapCode(userCode) {
+    return `(async () => {\n${userCode}\n})()`;
+}
+/**
+ * Extract a structured error object from an unknown thrown value.
+ * Handles isolated-vm timeout errors, memory errors, and generic JS errors.
+ */
+function extractErrorInfo(err) {
+    if (err instanceof Error) {
+        return {
+            name: err.name,
+            message: err.message,
+            stack: err.stack,
+        };
+    }
+    return {
+        name: 'Error',
+        message: String(err),
+    };
+}

package/dist/sandbox/tool-bridge.d.ts

@@ -0,0 +1,42 @@
+/**
+ * CodeAct Sandbox — Tool Bridge
+ *
+ * Bridges AgentTool instances into the isolated-vm sandbox as globally
+ * available async functions. Only tools marked `bridgeable: true` are
+ * injected. Each call is recorded for inclusion in ExecuteResult.toolCalls.
+ */
+import ivm from 'isolated-vm';
+import type { AgentTool } from '../tools/types.js';
+import type { SandboxToolCall } from './types.js';
+/**
+ * ToolBridge manages the injection of AgentTools into an isolated-vm
+ * Context and records every tool invocation made from sandbox code.
+ */
+export declare class ToolBridge {
+    private readonly tools;
+    private toolCalls;
+    constructor(tools: AgentTool[]);
+    /**
+     * Inject all bridgeable tools as global async functions in the given context.
+     *
+     * For each tool with `bridgeable: true`, a global function is registered
+     * using the tool's `bridgeName` (falling back to `name`). The sandbox
+     * function signature is:
+     *
+     *   async function toolName(args: object): Promise<string>
+     *
+     * The host-side callback executes the real tool, records the call, and
+     * returns the text result (or throws on error).
+     */
+    injectAll(context: ivm.Context): Promise<void>;
+    /** Return all tool call records accumulated since the last clear. */
+    getToolCalls(): SandboxToolCall[];
+    /** Clear accumulated tool call records. Called before each execute(). */
+    clearToolCalls(): void;
+    /**
+     * Validate that a function name is a safe JavaScript identifier.
+     * Prevents code injection via malicious tool names in evalClosure.
+     */
+    private static validateIdentifier;
+    private injectTool;
+}

package/dist/sandbox/tool-bridge.js

@@ -0,0 +1,98 @@
+/**
+ * CodeAct Sandbox — Tool Bridge
+ *
+ * Bridges AgentTool instances into the isolated-vm sandbox as globally
+ * available async functions. Only tools marked `bridgeable: true` are
+ * injected. Each call is recorded for inclusion in ExecuteResult.toolCalls.
+ */
+import ivm from 'isolated-vm';
+/**
+ * ToolBridge manages the injection of AgentTools into an isolated-vm
+ * Context and records every tool invocation made from sandbox code.
+ */
+export class ToolBridge {
+    tools;
+    toolCalls = [];
+    constructor(tools) {
+        this.tools = tools;
+    }
+    /**
+     * Inject all bridgeable tools as global async functions in the given context.
+     *
+     * For each tool with `bridgeable: true`, a global function is registered
+     * using the tool's `bridgeName` (falling back to `name`). The sandbox
+     * function signature is:
+     *
+     *   async function toolName(args: object): Promise<string>
+     *
+     * The host-side callback executes the real tool, records the call, and
+     * returns the text result (or throws on error).
+     */
+    async injectAll(context) {
+        const bridgeableTools = this.tools.filter((t) => t.bridgeable);
+        for (const tool of bridgeableTools) {
+            await this.injectTool(context, tool);
+        }
+    }
+    /** Return all tool call records accumulated since the last clear. */
+    getToolCalls() {
+        return [...this.toolCalls];
+    }
+    /** Clear accumulated tool call records. Called before each execute(). */
+    clearToolCalls() {
+        this.toolCalls = [];
+    }
+    // ---------------------------------------------------------------------------
+    // Private
+    // ---------------------------------------------------------------------------
+    /**
+     * Validate that a function name is a safe JavaScript identifier.
+     * Prevents code injection via malicious tool names in evalClosure.
+     */
+    static validateIdentifier(name) {
+        if (!/^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(name)) {
+            throw new Error(`Invalid bridge function name "${name}": must be a valid JS identifier (letters, digits, _, $)`);
+        }
+    }
+    async injectTool(context, tool) {
+        const fnName = tool.bridgeName || tool.name;
+        // SECURITY: Validate fnName is a safe identifier before interpolating into eval'd code.
+        ToolBridge.validateIdentifier(fnName);
+        // Host-side callback invoked when sandbox code calls the bridged function.
+        const callback = new ivm.Reference(async (argsJson) => {
+            const args = JSON.parse(argsJson);
+            const startTime = Date.now();
+            try {
+                const result = await tool.execute(`sandbox-${Date.now()}`, args, { signal: undefined });
+                const text = result.content
+                    .filter((c) => c.type === 'text')
+                    .map((c) => c.text)
+                    .join('\n');
+                this.toolCalls.push({
+                    toolName: tool.name,
+                    args,
+                    result: text,
+                    duration: Date.now() - startTime,
+                });
+                return text;
+            }
+            catch (err) {
+                const errMsg = err instanceof Error ? err.message : String(err);
+                this.toolCalls.push({
+                    toolName: tool.name,
+                    args,
+                    error: errMsg,
+                    duration: Date.now() - startTime,
+                });
+                throw new Error(errMsg);
+            }
+        });
+        // Register the async function in the sandbox's global scope.
+        // $0 is the ivm.Reference to the host callback.
+        // The sandbox function JSON-stringifies args before sending to host,
+        // and awaits the promise returned by the host callback.
+        await context.evalClosure(`globalThis.${fnName} = async function(args) {
+        return await $0.apply(undefined, [JSON.stringify(args)], { result: { promise: true } });
+      }`, [callback], { arguments: { reference: true } });
+    }
+}