@artemiskit/core 0.6.0 → 0.6.1

package/dist/index.js

@@ -33425,8 +33425,8 @@ var tools = [
   descriptor("search", "retrieval", "Search declared documents by case-insensitive literal text.", "documents", "read", object({ query: text }), object({ matches: { type: "array", maxItems: 100, items: object({ id: identifier }) } })),
   descriptor("read_document", "documents", "Read one document from simulated state.", "documents", "read", object({ id: identifier }), object({ id: identifier, content: { type: "string", maxLength: 16384 } })),
   descriptor("query_records", "records", "Read a bounded declared collection of structured records.", "records", "read", object({ collection: identifier }), object({ records: { type: "array", maxItems: 100, items: { type: "object" } } })),
-  descriptor("read_file", "files", "Read one relative file from in-memory fixture state.", "files", "read", object({ path: relativePath }), object({ content: { type: "string", maxLength: 16384 } })),
-  descriptor("write_file", "files", "Write one relative file in isolated in-memory state.", "files", "write", object({ path: relativePath, content: { type: "string", maxLength: 16384 } }), object({ path: relativePath, written: { const: true } })),
+  descriptor("read_file", "files", "Read one relative file from the isolated workflow environment.", "files", "read", object({ path: relativePath }), object({ content: { type: "string", maxLength: 16384 } })),
+  descriptor("write_file", "files", "Write one relative file in the isolated workflow environment.", "files", "write", object({ path: relativePath, content: { type: "string", maxLength: 16384 } }), object({ path: relativePath, written: { const: true } })),
   descriptor("calculator", "computation", "Perform one finite arithmetic operation without evaluating code.", "computation", "none", object({
     operation: { enum: ["add", "subtract", "multiply", "divide"] },
     a: { type: "number" },
@@ -33473,10 +33473,12 @@ function isWorkflowJson(value) {
     if (Array.isArray(item) && (item.length > 1e4 || Object.keys(item).length !== item.length || Object.keys(item).some((key, index) => key !== String(index))))
       return false;
     ancestors.add(item);
-    for (const key of Object.keys(item)) {
+    for (const key of Object.getOwnPropertyNames(item)) {
+      if (Array.isArray(item) && key === "length")
+        continue;
       textBytes += Buffer.byteLength(key);
       const entry = Object.getOwnPropertyDescriptor(item, key);
-      if (textBytes > 1048576 || forbiddenKeys.has(key) || !entry || !("value" in entry) || !visit(entry.value, depth + 1))
+      if (textBytes > 1048576 || forbiddenKeys.has(key) || !entry || !("value" in entry) || !entry.enumerable || !visit(entry.value, depth + 1))
         return false;
     }
     ancestors.delete(item);
@@ -33503,8 +33505,10 @@ var WorkflowPolicySchema = exports_external.object({
     communication: permission.optional(),
     coordination: permission.optional()
   }).strict(),
+  paths: exports_external.object({ read: exports_external.array(relativePath2).max(1000), write: exports_external.array(relativePath2).max(1000) }).strict().optional(),
   budgets: exports_external.object({
     max_actions: exports_external.number().int().min(1).max(1000),
+    max_model_requests: exports_external.number().int().min(1).max(1000).optional(),
     max_tool_calls: exports_external.number().int().min(1).max(1000).optional(),
     timeout_ms: exports_external.number().int().min(1).max(3600000),
     max_tokens: exports_external.number().int().min(1).max(1e6).optional()
@@ -33543,9 +33547,13 @@ var definition = exports_external.object({
   description: exports_external.string().max(4096).optional(),
   target: exports_external.object({
     provider: exports_external.string().min(1).max(64).regex(/^[a-z0-9_-]+$/),
-    model: exports_external.string().min(1).max(256)
+    model: exports_external.string().min(1).max(256),
+    generation: exports_external.object({
+      max_tokens: exports_external.number().int().min(1).max(1e6).optional(),
+      temperature: exports_external.number().min(0).max(2).optional()
+    }).strict().optional()
   }).strict(),
-  environment: exports_external.object({ type: exports_external.literal("simulated"), policy: WorkflowPolicySchema }).strict(),
+  environment: exports_external.object({ type: exports_external.enum(["simulated", "sandbox"]), policy: WorkflowPolicySchema }).strict(),
   tools: exports_external.array(exports_external.enum(WORKFLOW_TOOL_IDS)).min(1).max(WORKFLOW_TOOL_IDS.length),
   workflow: exports_external.object({
     system_instructions: exports_external.string().min(1).max(32768),
@@ -33808,6 +33816,7 @@ function executeSimulatedTool(request) {
 }
 // src/agent-workflow/target.ts
 var import_ajv4 = __toESM(require_ajv(), 1);
+import { createHash as createHash3 } from "node:crypto";
 var identifier2 = exports_external.string().min(1).max(256);
 var toolName = exports_external.string().regex(/^[a-zA-Z_][a-zA-Z0-9_-]{0,63}$/);
 var text2 = exports_external.string().max(1e6);
@@ -33823,7 +33832,7 @@ var messageSchema = exports_external.object({
   tool_calls: exports_external.array(toolCallSchema).min(1).max(100).optional()
 }).strict();
 var timeoutSchema = exports_external.number().int().min(1).max(2147483647);
-var requestSchema = exports_external.object({
+var agentTurnRequestSchema = exports_external.object({
   messages: exports_external.array(messageSchema).min(1).max(1000),
   tools: exports_external.array(exports_external.object({
     type: exports_external.literal("function"),
@@ -33847,6 +33856,7 @@ var requestSchema = exports_external.object({
   }).strict()
 }).strict();
 var resultSchema = exports_external.object({
+  usageAvailable: exports_external.boolean().optional(),
   id: identifier2,
   model: identifier2,
   text: text2,
@@ -33880,7 +33890,7 @@ function bounded(run, timeoutMs, signal) {
     Promise.resolve().then(() => signal?.aborted ? failure("error", "aborted") : run()).then(finish, () => finish(failure("error", "target_error")));
   });
 }
-function validTranscript(messages) {
+function validWorkflowTranscript(messages) {
   const seen = new Set;
   const pending = new Set;
   for (const message of messages) {
@@ -33911,14 +33921,30 @@ function createModelClientTarget(client) {
   if (!client || !identifier2.safeParse(client.provider).success || typeof client.generate !== "function" || typeof client.capabilities !== "function") {
     throw new TypeError("Invalid ModelClient");
   }
+  const pending = new Set;
+  const track = (promise) => {
+    pending.add(promise);
+    promise.then(() => pending.delete(promise), () => pending.delete(promise));
+    return promise;
+  };
   const readCapabilities = async () => {
-    const value = await client.capabilities();
+    const value = await track(client.capabilities());
     if (!value || typeof value.toolUse !== "boolean")
       return failure("invalid", "invalid_response");
-    return { status: "available", toolUse: value.toolUse, transportCancellation: false };
+    return {
+      status: "available",
+      toolUse: value.toolUse,
+      transportCancellation: value.transportCancellation === true
+    };
   };
   return {
     provider: client.provider,
+    async drain({ timeoutMs }) {
+      if (!timeoutSchema.safeParse(timeoutMs).success)
+        return { pendingOperations: pending.size };
+      await bounded(() => Promise.allSettled([...pending]), timeoutMs);
+      return { pendingOperations: pending.size };
+    },
     async capabilities(options, signal) {
       if (!timeoutSchema.safeParse(options?.timeoutMs).success)
         return failure("invalid", "invalid_request");
@@ -33927,11 +33953,11 @@ function createModelClientTarget(client) {
     async turn(request, signal) {
       let parsed;
       try {
-        parsed = requestSchema.safeParse(request);
+        parsed = agentTurnRequestSchema.safeParse(request);
       } catch {
         return failure("invalid", "invalid_request");
       }
-      if (!parsed.success || !validTranscript(parsed.data.messages))
+      if (!parsed.success || !validWorkflowTranscript(parsed.data.messages))
         return failure("invalid", "invalid_request");
       const input = parsed.data;
       const validators4 = new Map;
@@ -33952,6 +33978,12 @@ function createModelClientTarget(client) {
         return failure("invalid", "invalid_request");
       }
       const started = Date.now();
+      const controller = new AbortController;
+      const abort = () => controller.abort();
+      signal?.addEventListener("abort", abort, { once: true });
+      if (signal?.aborted)
+        controller.abort();
+      const timer = setTimeout(abort, input.budgets.timeoutMs);
       return bounded(async () => {
         const capabilities = await readCapabilities();
         if (capabilities.status !== "available")
@@ -33963,12 +33995,14 @@ function createModelClientTarget(client) {
         if (Date.now() - started >= input.budgets.timeoutMs)
           return failure("error", "timeout");
         const options = {
+          maxRetries: 0,
           prompt: input.messages,
           tools: input.tools,
           model: input.model,
-          ...input.generation
+          ...input.generation,
+          ...capabilities.transportCancellation ? { signal: controller.signal } : {}
         };
-        const generated = resultSchema.safeParse(await client.generate(options));
+        const generated = resultSchema.safeParse(await track(client.generate(options)));
         if (!generated.success)
           return failure("invalid", "invalid_response");
         const result = generated.data;
@@ -33976,17 +34010,29 @@ function createModelClientTarget(client) {
         if (result.functionCall !== undefined || result.finishReason === "function_call" || result.finishReason === "tool_calls" && calls.length === 0 || calls.length > input.budgets.maxToolCalls || result.tokens.total !== result.tokens.prompt + result.tokens.completion)
           return failure("invalid", "invalid_response");
         const ids = new Set(input.messages.flatMap((message) => message.tool_calls?.map((call) => call.id) ?? []));
+        const rejected = (call, reason) => ({
+          ...failure("invalid", "invalid_response"),
+          tokens: result.tokens,
+          ...result.usageAvailable !== undefined ? { usageAvailable: result.usageAvailable } : {},
+          rejectedCall: {
+            requestedCallIdHash: createHash3("sha256").update(call.id).digest("hex"),
+            tool: getWorkflowTool(call.function.name)?.id ?? "unknown",
+            reason
+          }
+        });
         for (const call of calls) {
           if (ids.has(call.id))
-            return failure("invalid", "invalid_response");
+            return rejected(call, "duplicate_id");
           ids.add(call.id);
           const validate2 = validators4.get(call.function.name);
+          if (!validate2)
+            return rejected(call, "undeclared_tool");
           try {
             const args = JSON.parse(call.function.arguments);
             if (!args || typeof args !== "object" || Array.isArray(args) || !validate2 || validate2(args) !== true)
-              return failure("invalid", "invalid_response");
+              return rejected(call, "invalid_arguments");
           } catch {
-            return failure("invalid", "invalid_response");
+            return rejected(call, "invalid_arguments");
           }
         }
         return {
@@ -33999,15 +34045,1301 @@ function createModelClientTarget(client) {
             ...calls.length ? { tool_calls: calls } : {}
           },
           tokens: result.tokens,
+          ...result.usageAvailable !== undefined ? { usageAvailable: result.usageAvailable } : {},
           latencyMs: result.latencyMs,
           finishReason: result.finishReason
         };
-      }, input.budgets.timeoutMs, signal);
+      }, input.budgets.timeoutMs, signal).then((result) => controller.signal.aborted ? failure("error", signal?.aborted ? "aborted" : "timeout") : result).finally(() => {
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", abort);
+      });
     }
   };
 }
-// src/validator/validator.ts
+// src/agent-workflow/environment.ts
 var import_yaml3 = __toESM(require_dist(), 1);
+import { constants } from "node:fs";
+import { lstat, open, realpath } from "node:fs/promises";
+import { join as join3, resolve as resolve3 } from "node:path";
+class WorkflowEnvironmentInitializationError extends Error {
+  cleanup;
+  constructor(cleanup) {
+    super("environment_initialization_failed");
+    this.cleanup = cleanup;
+  }
+}
+function isWorkflowState(value) {
+  return isWorkflowJson(value) && value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function workflowPathAllowed(workflow, tool, input) {
+  if (tool !== "read_file" && tool !== "write_file")
+    return true;
+  if (!isWorkflowState(input) || typeof input.path !== "string" || !isWorkflowRelativePath(input.path))
+    return false;
+  const paths = workflow.environment.policy.paths;
+  return !paths || (tool === "read_file" ? paths.read : paths.write).includes(input.path);
+}
+function workflowToolPermitted(workflow, tool) {
+  const descriptor2 = getWorkflowTool(tool);
+  if (!descriptor2 || !workflow.tools.includes(descriptor2.id))
+    return false;
+  if (descriptor2.authority.access === "none")
+    return true;
+  const grant = workflow.environment.policy.permissions[descriptor2.authority.resource];
+  return grant === "write" || grant === "read" && descriptor2.authority.access === "read";
+}
+async function resolveWorkflowInitialState(workflow, fixtureRoot) {
+  const initial = workflow.workflow.initial_state;
+  if (typeof initial !== "string") {
+    if (!isWorkflowState(initial))
+      throw new Error("invalid_fixture");
+    return structuredClone(initial);
+  }
+  if (!fixtureRoot || !isWorkflowRelativePath(initial) || !/\.(json|ya?ml)$/i.test(initial) || initial.split("/").some((part) => part.startsWith(".") || /(?:^|[._-])(?:secrets?|credentials?|tokens?|private|id_rsa|id_ed25519)(?:[._-]|$)/i.test(part)))
+    throw new Error("invalid_fixture");
+  const root = resolve3(fixtureRoot);
+  const canonicalRoot = await realpath(root);
+  let current = canonicalRoot;
+  const ancestry = [];
+  const parts = initial.split("/");
+  for (const [index, part] of parts.entries()) {
+    current = join3(current, part);
+    const stat2 = await lstat(current);
+    if (stat2.isSymbolicLink() || (index < parts.length - 1 ? !stat2.isDirectory() : !stat2.isFile()))
+      throw new Error("invalid_fixture");
+    ancestry.push({ path: current, ino: stat2.ino, dev: stat2.dev });
+  }
+  const file = await open(current, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const stat2 = await file.stat();
+    const expected = ancestry[ancestry.length - 1];
+    if (!stat2.isFile() || stat2.size > 1048576 || stat2.ino !== expected.ino || stat2.dev !== expected.dev)
+      throw new Error("invalid_fixture");
+    const buffer = Buffer.alloc(1048577);
+    let length = 0;
+    while (length < buffer.length) {
+      const { bytesRead } = await file.read(buffer, length, buffer.length - length, null);
+      if (!bytesRead)
+        break;
+      length += bytesRead;
+    }
+    if (length > 1048576)
+      throw new Error("invalid_fixture");
+    for (const entry of ancestry) {
+      const after = await lstat(entry.path);
+      if (after.isSymbolicLink() || after.ino !== entry.ino || after.dev !== entry.dev)
+        throw new Error("invalid_fixture");
+    }
+    const document2 = import_yaml3.parseDocument(buffer.subarray(0, length).toString("utf8"), {
+      uniqueKeys: true,
+      customTags: []
+    });
+    if (document2.errors.length || document2.warnings.length)
+      throw new Error("invalid_fixture");
+    const value = document2.toJS({ maxAliasCount: 0 });
+    if (!isWorkflowState(value))
+      throw new Error("invalid_fixture");
+    return value;
+  } finally {
+    await file.close();
+  }
+}
+var createSimulatedWorkflowEnvironment = async ({
+  workflow,
+  initialState,
+  signal
+}) => {
+  if (workflow.environment.type !== "simulated" || signal.aborted || !isWorkflowState(initialState))
+    throw new Error("environment_unavailable");
+  const configuration = structuredClone(workflow);
+  let state = structuredClone(initialState);
+  let closed = false;
+  return {
+    type: "simulated",
+    capabilities: {
+      network: "denied",
+      commands: "denied",
+      externalSideEffects: "denied",
+      isolation: "memory"
+    },
+    async execute(request, executionSignal) {
+      if (closed || executionSignal.aborted)
+        throw new Error("environment_unavailable");
+      if (!workflowPathAllowed(configuration, request.tool, request.input))
+        return {
+          status: "denied",
+          code: "permission_denied",
+          evidence: {
+            tool: getWorkflowTool(request.tool)?.id ?? "unknown",
+            version: "1",
+            status: "denied",
+            code: "permission_denied"
+          }
+        };
+      const result = executeSimulatedTool({
+        ...request,
+        state,
+        policy: configuration.environment.policy,
+        declaredTools: configuration.tools
+      });
+      if (result.status === "succeeded")
+        state = structuredClone(result.state);
+      return result;
+    },
+    async snapshot(snapshotSignal) {
+      if (closed || snapshotSignal.aborted)
+        throw new Error("environment_unavailable");
+      return structuredClone(state);
+    },
+    async close() {
+      closed = true;
+      state = {};
+      return { status: "completed", artifacts: "discarded" };
+    }
+  };
+};
+// src/agent-workflow/sandbox.ts
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+var WORKFLOW_SANDBOX_IMAGE = "oven/bun:1.3.10-alpine";
+var LIMIT = 1048576;
+var OWNER_LABEL = "artemiskit.workflow.owner";
+var FILE_PROGRAM = String.raw`
+const fs = require('node:fs');
+const root = '/workspace';
+const limit = 1048576;
+const safe = p => typeof p === 'string' && p.length <= 512 && /^[A-Za-z0-9_-][A-Za-z0-9_./-]*$/.test(p) && p.split('/').every(x => x && !['.','..','__proto__','prototype','constructor'].includes(x));
+function checked(p, create=false) {
+  if (!safe(p)) throw 'invalid_input';
+  const parts = p.split('/'); let current = root;
+  for (let i=0;i<parts.length;i++) {
+    current += '/' + parts[i];
+    let stat;
+    try { stat = fs.lstatSync(current); } catch(e) { if(e.code !== 'ENOENT') throw 'tool_error'; }
+    if (stat && (stat.isSymbolicLink() || (i<parts.length-1 ? !stat.isDirectory() : !stat.isFile()))) throw 'invalid_input';
+    if (!stat && i<parts.length-1) { if(!create) throw 'not_found'; fs.mkdirSync(current, {mode: 0o700}); }
+  }
+  return current;
+}
+function write(p, content) {
+  if(typeof content !== 'string' || content.length>16384) throw 'invalid_input';
+  const path=checked(p,true); const fd=fs.openSync(path, fs.constants.O_WRONLY|fs.constants.O_CREAT|fs.constants.O_TRUNC|fs.constants.O_NOFOLLOW,0o600);
+  try { fs.writeFileSync(fd,content,'utf8'); } finally { fs.closeSync(fd); }
+}
+function read(p) {
+  const path=checked(p); let fd;
+  try { fd=fs.openSync(path,fs.constants.O_RDONLY|fs.constants.O_NOFOLLOW); } catch(e) { if(e.code==='ENOENT') throw 'not_found'; throw 'tool_error'; }
+  try { const stat=fs.fstatSync(fd); if(!stat.isFile() || stat.size>65536) throw 'output_limit'; const text=fs.readFileSync(fd,'utf8'); if(text.length>16384) throw 'output_limit'; return text; } finally { fs.closeSync(fd); }
+}
+function snapshot() {
+  const files={}; let count=0, bytes=0;
+  function walk(dir, prefix, depth) {
+    if(depth>16) throw 'output_limit';
+    for(const name of fs.readdirSync(dir).sort()) {
+      const p=prefix ? prefix+'/'+name : name;
+      if(!safe(p) || ++count>1000) throw 'output_limit';
+      const stat=fs.lstatSync(dir+'/'+name);
+      if(stat.isSymbolicLink()) throw 'invalid_input';
+      if(stat.isDirectory()) walk(dir+'/'+name,p,depth+1);
+      else if(stat.isFile()) { const value=read(p); bytes+=Buffer.byteLength(value)+Buffer.byteLength(p); if(bytes>limit) throw 'output_limit'; files[p]=value; }
+      else throw 'invalid_input';
+    }
+  }
+  walk(root,'',0); return files;
+}
+try {
+  const raw=await Bun.stdin.text(); if(Buffer.byteLength(raw)>limit) throw 'invalid_input';
+  const request=JSON.parse(raw); let output;
+  if(request.action==='init') { for(const [path,content] of Object.entries(request.files)) write(path,content); }
+  else if(request.action==='write') { write(request.path,request.content); output={path:request.path,written:true}; }
+  else if(request.action==='read') output={content:read(request.path)};
+  else if(request.action!=='snapshot') throw 'invalid_input';
+  const result=JSON.stringify({ok:true,files:snapshot(),...(output?{output}:{})}); if(Buffer.byteLength(result)>limit) throw 'output_limit'; process.stdout.write(result);
+} catch(error) { process.stdout.write(JSON.stringify({ok:false,code:['invalid_input','not_found','output_limit'].includes(error)?error:'tool_error'})); process.exitCode=1; }
+`;
+
+class DockerFailure extends Error {
+  code;
+  uncertain;
+  constructor(code, uncertain = false) {
+    super(`sandbox_${code}`);
+    this.code = code;
+    this.uncertain = uncertain;
+  }
+}
+function createDockerWorkflowEnvironmentFactory(options = {}) {
+  const operationTimeoutMs = options.operationTimeoutMs ?? 5000;
+  const cleanupTimeoutMs = options.cleanupTimeoutMs ?? 3000;
+  if (Object.keys(options).some((key) => !["operationTimeoutMs", "cleanupTimeoutMs"].includes(key)) || !Number.isInteger(operationTimeoutMs) || operationTimeoutMs < 1 || operationTimeoutMs > 30000 || !Number.isInteger(cleanupTimeoutMs) || cleanupTimeoutMs < 1 || cleanupTimeoutMs > 1e4)
+    throw new TypeError("Invalid Docker workflow environment options");
+  return async ({ workflow, initialState, signal }) => {
+    const parsed = AgentWorkflowSchema.safeParse(workflow);
+    if (!parsed.success || parsed.data.environment.type !== "sandbox" || !isWorkflowState(initialState) || signal.aborted)
+      throw new WorkflowEnvironmentInitializationError({
+        status: "completed",
+        artifacts: "discarded",
+        pendingOperations: 0
+      });
+    const configuration = parsed.data;
+    let state = structuredClone(initialState);
+    const files = state.files ?? {};
+    if (!isWorkflowState(files) || Object.entries(files).some(([path, content]) => !isWorkflowRelativePath(path) || typeof content !== "string" || content.length > 16384) || Object.keys(files).length > 1000)
+      throw new WorkflowEnvironmentInitializationError({
+        status: "completed",
+        artifacts: "discarded",
+        pendingOperations: 0
+      });
+    const owner = randomUUID();
+    const name = `artemiskit-workflow-${owner}`;
+    const children = new Set;
+    let closed = false;
+    let closing = false;
+    let creationAttempted = false;
+    let creationUncertain = false;
+    let busy = false;
+    const command = (args, input, commandSignal, timeoutMs = operationTimeoutMs) => {
+      if (commandSignal.aborted)
+        return Promise.reject(new DockerFailure("aborted"));
+      if (Buffer.byteLength(input) > LIMIT)
+        return Promise.reject(new DockerFailure("output_limit"));
+      return new Promise((resolve4, reject) => {
+        let child;
+        try {
+          child = spawn("docker", args, { stdio: ["pipe", "pipe", "pipe"] });
+        } catch {
+          reject(new DockerFailure("unavailable"));
+          return;
+        }
+        children.add(child);
+        const output = [];
+        let size = 0;
+        let failure2;
+        let settled = false;
+        const stop = (error2) => {
+          failure2 ??= error2;
+          child.kill("SIGKILL");
+        };
+        const abort = () => stop(new DockerFailure("aborted", true));
+        const timer = setTimeout(() => stop(new DockerFailure("timeout", true)), timeoutMs);
+        commandSignal.addEventListener("abort", abort, { once: true });
+        child.stdout?.on("data", (chunk) => {
+          size += chunk.length;
+          if (size > LIMIT)
+            stop(new DockerFailure("output_limit", true));
+          else
+            output.push(Buffer.from(chunk));
+        });
+        child.stderr?.on("data", (chunk) => {
+          size += chunk.length;
+          if (size > LIMIT)
+            stop(new DockerFailure("output_limit", true));
+        });
+        child.stdin?.on("error", () => {});
+        const finish = (code, error2) => {
+          if (settled)
+            return;
+          settled = true;
+          clearTimeout(timer);
+          commandSignal.removeEventListener("abort", abort);
+          children.delete(child);
+          if (error2 || failure2)
+            reject(error2 ?? failure2);
+          else
+            resolve4({ code: code ?? 1, stdout: Buffer.concat(output).toString("utf8") });
+        };
+        child.once("error", () => finish(null, new DockerFailure("unavailable")));
+        child.once("close", (code) => finish(code));
+        child.stdin?.end(input);
+        if (commandSignal.aborted)
+          abort();
+      });
+    };
+    async function close(closeSignal) {
+      if (closed)
+        return { status: "completed", artifacts: "discarded" };
+      closing = true;
+      for (const child of children)
+        child.kill("SIGKILL");
+      const cleanupController = new AbortController;
+      const onAbort = () => cleanupController.abort();
+      closeSignal.addEventListener("abort", onAbort, { once: true });
+      if (closeSignal.aborted)
+        cleanupController.abort();
+      const timer = setTimeout(onAbort, cleanupTimeoutMs);
+      try {
+        if (!creationAttempted) {
+          closed = true;
+          state = {};
+          return { status: "completed", artifacts: "discarded" };
+        }
+        const inspected = await command(["inspect", "--format", `{{index .Config.Labels "${OWNER_LABEL}"}}`, name], "", cleanupController.signal, cleanupTimeoutMs);
+        if (inspected.code === 0) {
+          if (inspected.stdout.trim() !== owner)
+            return { status: "unresolved", artifacts: "unknown" };
+          const removed = await command(["rm", "--force", name], "", cleanupController.signal, cleanupTimeoutMs);
+          if (removed.code !== 0)
+            return { status: "unresolved", artifacts: "unknown" };
+          creationUncertain = false;
+        }
+        const remaining = await command(["ps", "--all", "--filter", `name=^/${name}$`, "--format", "{{.Names}}"], "", cleanupController.signal, cleanupTimeoutMs);
+        if (remaining.code !== 0 || remaining.stdout.trim() || creationUncertain || children.size > 0)
+          return { status: "unresolved", artifacts: "unknown" };
+        closed = true;
+        state = {};
+        return { status: "completed", artifacts: "discarded" };
+      } catch {
+        return { status: "unresolved", artifacts: "unknown" };
+      } finally {
+        clearTimeout(timer);
+        closeSignal.removeEventListener("abort", onAbort);
+      }
+    }
+    async function fileOperation(request, operationSignal) {
+      const result = await command(["exec", "--interactive", name, "bun", "--eval", FILE_PROGRAM], JSON.stringify(request), operationSignal);
+      let response;
+      try {
+        response = JSON.parse(result.stdout);
+      } catch {
+        throw new DockerFailure("unavailable");
+      }
+      if (!isWorkflowState(response))
+        throw new DockerFailure("unavailable");
+      if (response.ok === false && ["invalid_input", "not_found", "output_limit", "tool_error"].includes(String(response.code)))
+        return {
+          ok: false,
+          code: response.code
+        };
+      if (result.code !== 0 || response.ok !== true || !isWorkflowState(response.files) || Object.entries(response.files).some(([path, content]) => !isWorkflowRelativePath(path) || typeof content !== "string" || content.length > 16384))
+        throw new DockerFailure("unavailable");
+      const next = { ...state, files: response.files };
+      if (!isWorkflowState(next))
+        throw new DockerFailure("output_limit");
+      state = structuredClone(next);
+      return { ok: true, output: response.output };
+    }
+    try {
+      const image = await command(["image", "inspect", WORKFLOW_SANDBOX_IMAGE, "--format", "{{.Id}}"], "", signal);
+      if (image.code !== 0 || !/^sha256:[a-f0-9]{64}\s*$/.test(image.stdout))
+        throw new DockerFailure("unavailable");
+      creationAttempted = true;
+      let created;
+      try {
+        created = await command([
+          "create",
+          "--pull=never",
+          "--name",
+          name,
+          "--label",
+          "artemiskit.workflow=true",
+          "--label",
+          `${OWNER_LABEL}=${owner}`,
+          "--network",
+          "none",
+          "--read-only",
+          "--cap-drop",
+          "ALL",
+          "--security-opt",
+          "no-new-privileges",
+          "--memory",
+          "128m",
+          "--memory-swap",
+          "128m",
+          "--cpus",
+          "0.5",
+          "--pids-limit",
+          "64",
+          "--user",
+          "1000:1000",
+          "--tmpfs",
+          "/workspace:rw,noexec,nosuid,nodev,size=16777216,uid=1000,gid=1000,mode=0700",
+          "--tmpfs",
+          "/tmp:rw,noexec,nosuid,nodev,size=8388608,uid=1000,gid=1000,mode=0700",
+          "--workdir",
+          "/workspace",
+          "--entrypoint",
+          "bun",
+          image.stdout.trim(),
+          "--eval",
+          "setInterval(() => {}, 1000)"
+        ], "", signal);
+      } catch (error2) {
+        creationUncertain = error2 instanceof DockerFailure && error2.uncertain;
+        throw error2;
+      }
+      if (created.code !== 0)
+        throw new DockerFailure("unavailable");
+      const started = await command(["start", name], "", signal);
+      if (started.code !== 0)
+        throw new DockerFailure("unavailable");
+      const initialized2 = await fileOperation({ action: "init", files }, signal);
+      if (!initialized2.ok)
+        throw new DockerFailure("unavailable");
+    } catch {
+      const cleanup = await close(new AbortController().signal);
+      throw new WorkflowEnvironmentInitializationError({
+        ...cleanup,
+        pendingOperations: children.size + (creationUncertain ? 1 : 0)
+      });
+    }
+    return {
+      type: "sandbox",
+      capabilities: {
+        network: "denied",
+        commands: "denied",
+        externalSideEffects: "denied",
+        isolation: "container"
+      },
+      async execute(request, operationSignal) {
+        const tool = getWorkflowTool(request.tool)?.id ?? "unknown";
+        const failure2 = (status, code) => ({
+          status,
+          code,
+          evidence: { tool, version: "1", status, code }
+        });
+        if (closed || closing || busy || operationSignal.aborted || signal.aborted)
+          return failure2("failed", "tool_error");
+        const checked = executeSimulatedTool({
+          tool: request.tool,
+          input: request.input,
+          state,
+          policy: configuration.environment.policy,
+          declaredTools: configuration.tools
+        });
+        if (checked.status === "invalid" && checked.code === "invalid_input")
+          return checked;
+        if (!workflowPathAllowed(configuration, request.tool, request.input))
+          return failure2("denied", "permission_denied");
+        if (checked.status !== "succeeded")
+          return checked;
+        busy = true;
+        try {
+          if (request.tool === "read_file" || request.tool === "write_file") {
+            if (!isWorkflowState(request.input))
+              return failure2("invalid", "invalid_input");
+            const result = await fileOperation({ action: request.tool === "read_file" ? "read" : "write", ...request.input }, operationSignal);
+            if (!result.ok)
+              return failure2(result.code === "invalid_input" ? "invalid" : "failed", result.code);
+            if (!isWorkflowJson(result.output))
+              return failure2("failed", "tool_error");
+            return {
+              status: "succeeded",
+              output: structuredClone(result.output),
+              state: structuredClone(state),
+              evidence: { tool, version: "1", status: "succeeded" }
+            };
+          }
+          state = structuredClone(checked.state);
+          return checked;
+        } catch {
+          return failure2("failed", "tool_error");
+        } finally {
+          busy = false;
+        }
+      },
+      async snapshot(snapshotSignal) {
+        if (closed || closing || busy || snapshotSignal.aborted)
+          throw new DockerFailure("unavailable");
+        busy = true;
+        try {
+          const result = await fileOperation({ action: "snapshot" }, snapshotSignal);
+          if (!result.ok)
+            throw new DockerFailure("unavailable");
+          return structuredClone(state);
+        } finally {
+          busy = false;
+        }
+      },
+      close
+    };
+  };
+}
+var createDockerWorkflowEnvironment = createDockerWorkflowEnvironmentFactory();
+// src/agent-workflow/session.ts
+var import_ajv5 = __toESM(require_ajv(), 1);
+import { createHash as createHash4, randomUUID as randomUUID2 } from "node:crypto";
+var hash = (value) => createHash4("sha256").update(value).digest("hex");
+function identity(value) {
+  return {
+    sha256: hash(value),
+    .../^[A-Za-z][A-Za-z0-9._:/-]{0,127}$/.test(value) && !/(?:secret|token|password|credential|api.?key|^sk-|^npm_)/i.test(value) ? { display: value } : {}
+  };
+}
+var zeroUsage = () => ({ prompt: 0, completion: 0, total: 0 });
+var usageSchema = exports_external.object({
+  prompt: exports_external.number().int().nonnegative().safe(),
+  completion: exports_external.number().int().nonnegative().safe(),
+  total: exports_external.number().int().nonnegative().safe()
+}).strict();
+var callSchema = exports_external.object({
+  id: exports_external.string().min(1).max(256),
+  type: exports_external.literal("function"),
+  function: exports_external.object({
+    name: exports_external.string().regex(/^[a-zA-Z_][a-zA-Z0-9_-]{0,63}$/),
+    arguments: exports_external.string().max(1e6)
+  }).strict()
+}).strict();
+var completedSchema = exports_external.object({
+  status: exports_external.literal("completed"),
+  id: exports_external.string().min(1).max(256),
+  model: exports_external.string().min(1).max(256),
+  message: exports_external.object({
+    role: exports_external.literal("assistant"),
+    content: exports_external.string().max(1e6),
+    tool_calls: exports_external.array(callSchema).max(100).optional()
+  }).strict(),
+  tokens: usageSchema,
+  usageAvailable: exports_external.boolean().optional(),
+  latencyMs: exports_external.number().finite().nonnegative(),
+  finishReason: exports_external.enum(["stop", "length", "tool_calls", "content_filter"]).optional()
+}).strict();
+var failureSchema = exports_external.object({
+  status: exports_external.enum(["unsupported", "invalid", "error"]),
+  tokens: usageSchema.optional(),
+  usageAvailable: exports_external.boolean().optional(),
+  rejectedCall: exports_external.object({
+    requestedCallIdHash: exports_external.string().regex(/^[a-f0-9]{64}$/),
+    tool: exports_external.string(),
+    reason: exports_external.enum(["undeclared_tool", "invalid_arguments", "duplicate_id"])
+  }).strict().optional(),
+  code: exports_external.enum([
+    "invalid_request",
+    "tool_use_unsupported",
+    "invalid_response",
+    "target_error",
+    "timeout",
+    "aborted"
+  ])
+}).strict();
+var capabilitySchema = exports_external.object({
+  status: exports_external.literal("available"),
+  toolUse: exports_external.boolean(),
+  transportCancellation: exports_external.boolean()
+}).strict();
+var cleanupSchema = exports_external.object({
+  status: exports_external.enum(["completed", "unresolved"]),
+  artifacts: exports_external.enum(["discarded", "retained", "unknown"])
+}).strict();
+var failureCodes = new Set([
+  "undeclared_tool",
+  "permission_denied",
+  "invalid_input",
+  "invalid_state",
+  "not_found",
+  "output_limit",
+  "invalid_policy",
+  "tool_error"
+]);
+function safeBoundary(value) {
+  let nodes = 0;
+  let bytes = 0;
+  const parents = new Set;
+  function check(item, depth) {
+    if (++nodes > 1e4 || depth > 16)
+      return false;
+    if (item === undefined || item === null || typeof item === "boolean")
+      return true;
+    if (typeof item === "number")
+      return Number.isFinite(item);
+    if (typeof item === "string") {
+      bytes += Buffer.byteLength(item);
+      return bytes <= 1048576;
+    }
+    if (typeof item !== "object" || parents.has(item) || !Array.isArray(item) && Object.getPrototypeOf(item) !== Object.prototype && Object.getPrototypeOf(item) !== null)
+      return false;
+    if (Object.getOwnPropertySymbols(item).length || Array.isArray(item) && item.length > 1e4)
+      return false;
+    parents.add(item);
+    for (const key of Object.getOwnPropertyNames(item)) {
+      if (Array.isArray(item) && key === "length")
+        continue;
+      bytes += Buffer.byteLength(key);
+      const descriptor2 = Object.getOwnPropertyDescriptor(item, key);
+      if (bytes > 1048576 || ["__proto__", "constructor", "prototype"].includes(key) || !descriptor2 || !("value" in descriptor2) || !descriptor2.enumerable || !check(descriptor2.value, depth + 1))
+        return false;
+    }
+    parents.delete(item);
+    return true;
+  }
+  try {
+    return check(value, 0);
+  } catch {
+    return false;
+  }
+}
+
+class Stop extends Error {
+  execution;
+  reason;
+  constructor(execution, reason) {
+    super(reason);
+    this.execution = execution;
+    this.reason = reason;
+  }
+}
+function createAgentWorkflowSession(options) {
+  const controller = new AbortController;
+  let sessionState = "idle";
+  let promise;
+  let workflow;
+  try {
+    workflow = AgentWorkflowSchema.parse(options.workflow);
+  } catch {}
+  const target = options.target;
+  const retained = [];
+  const listeners = new Set;
+  let finished = false;
+  let started = 0;
+  let eventSequence = 0;
+  const record = {
+    schemaVersion: "1",
+    engine: "native",
+    execution: "invalid",
+    reason: "invalid_workflow",
+    policy: "passed",
+    ...workflow ? {
+      configuration: {
+        sha256: hash(JSON.stringify(workflow)),
+        provider: identity(workflow.target.provider),
+        model: identity(workflow.target.model),
+        generation: {
+          maxTokens: workflow.target.generation?.max_tokens ?? 1024,
+          temperature: workflow.target.generation?.temperature ?? 0
+        },
+        limits: structuredClone(workflow.environment.policy.budgets)
+      }
+    } : {},
+    taskVerification: "unavailable",
+    environment: workflow?.environment.type ?? "unknown",
+    capability: {
+      advertised: null,
+      transportCancellation: false,
+      preflight: options.preflight || options.preflightOnly ? "failed" : "not_requested"
+    },
+    usage: {
+      status: "unavailable",
+      reported: zeroUsage(),
+      missingRequests: 0,
+      inFlightUnknown: false,
+      preflight: zeroUsage()
+    },
+    budgets: {
+      actions: 0,
+      modelRequests: 0,
+      toolCalls: 0,
+      modelRequestAccounting: "target_invocations",
+      transportAttempts: "unavailable",
+      tokenOvershoot: 0,
+      elapsedMs: 0
+    },
+    cleanup: { status: "completed", artifacts: "discarded", pendingOperations: 0 },
+    artifacts: { state: "unavailable" },
+    events: retained,
+    droppedEvents: 0
+  };
+  const pending = new Set;
+  const modelPending = new Set;
+  let transcript = [];
+  let state = null;
+  let environment;
+  let deadlineExpired = false;
+  let phase = "execution";
+  let measuredRequests = 0;
+  const ids = new Set;
+  const emit = (event) => {
+    const value = {
+      ...event,
+      sequence: ++eventSequence,
+      elapsedMs: Math.max(0, Date.now() - started),
+      phase
+    };
+    if (retained.length < 255 || value.type === "finished")
+      retained.push(value);
+    else
+      record.droppedEvents++;
+    try {
+      options.onEvent?.(structuredClone(value));
+    } catch {}
+    for (const wake of listeners)
+      wake();
+  };
+  const abort = () => {
+    if (!finished) {
+      controller.abort();
+      if (sessionState === "running")
+        sessionState = "cancelling";
+    }
+  };
+  options.signal?.addEventListener("abort", abort, { once: true });
+  if (options.signal?.aborted)
+    abort();
+  function active() {
+    if (controller.signal.aborted)
+      throw new Stop(deadlineExpired ? "timeout" : "cancelled", deadlineExpired ? "deadline" : "cancelled");
+    if (workflow && Date.now() - started >= workflow.environment.policy.budgets.timeout_ms) {
+      deadlineExpired = true;
+      controller.abort();
+      throw new Stop("timeout", "deadline");
+    }
+  }
+  async function owned(operation, signal, isModel = false) {
+    if (signal.aborted)
+      throw new Stop(deadlineExpired ? "timeout" : "cancelled", deadlineExpired ? "deadline" : "cancelled");
+    const work = Promise.resolve().then(() => {
+      if (signal.aborted)
+        throw new Stop("cancelled", "cancelled");
+      return operation();
+    });
+    pending.add(work);
+    if (isModel)
+      modelPending.add(work);
+    work.then(() => {
+      pending.delete(work);
+      modelPending.delete(work);
+    }, () => {
+      pending.delete(work);
+      modelPending.delete(work);
+    });
+    return new Promise((resolve4, reject) => {
+      const onAbort = () => {
+        signal.removeEventListener("abort", onAbort);
+        reject(new Stop(deadlineExpired ? "timeout" : "cancelled", deadlineExpired ? "deadline" : "cancelled"));
+      };
+      signal.addEventListener("abort", onAbort, { once: true });
+      work.then((value) => {
+        signal.removeEventListener("abort", onAbort);
+        resolve4(value);
+      }, (error2) => {
+        signal.removeEventListener("abort", onAbort);
+        reject(error2);
+      });
+    });
+  }
+  function admit(kind) {
+    active();
+    if (!workflow)
+      throw new Stop("invalid", "invalid_workflow");
+    const budget = workflow.environment.policy.budgets;
+    if (record.budgets.actions >= budget.max_actions)
+      throw new Stop("budget_exceeded", "max_actions");
+    if (kind === "model" && record.budgets.modelRequests >= (budget.max_model_requests ?? budget.max_actions))
+      throw new Stop("budget_exceeded", "max_model_requests");
+    if (kind === "tool" && record.budgets.toolCalls >= (budget.max_tool_calls ?? budget.max_actions))
+      throw new Stop("budget_exceeded", "max_tool_calls");
+    if (budget.max_tokens !== undefined) {
+      if (record.usage.missingRequests)
+        throw new Stop("budget_exceeded", "usage_unavailable");
+      if (record.usage.reported.total >= budget.max_tokens)
+        throw new Stop("budget_exceeded", "max_tokens");
+    }
+    record.budgets.actions++;
+    if (kind === "model")
+      record.budgets.modelRequests++;
+    else
+      record.budgets.toolCalls++;
+  }
+  const ajv3 = new import_ajv5.default({
+    strict: true,
+    allErrors: false,
+    coerceTypes: false,
+    useDefaults: false,
+    removeAdditional: false
+  });
+  async function model(messages, tools2) {
+    if (!workflow)
+      throw new Stop("invalid", "invalid_workflow");
+    const budget = workflow.environment.policy.budgets;
+    const remainingTokens = budget.max_tokens === undefined ? 1e6 : Math.max(1, budget.max_tokens - record.usage.reported.total);
+    const request = {
+      messages: structuredClone(messages),
+      tools: structuredClone(tools2),
+      model: workflow.target.model,
+      generation: {
+        maxTokens: Math.min(workflow.target.generation?.max_tokens ?? 1024, remainingTokens),
+        temperature: workflow.target.generation?.temperature ?? 0
+      },
+      budgets: {
+        timeoutMs: Math.max(1, budget.timeout_ms - (Date.now() - started)),
+        maxToolCalls: 100
+      }
+    };
+    if (!safeBoundary(request) || !agentTurnRequestSchema.safeParse(request).success || !validWorkflowTranscript(messages))
+      throw new Stop("invalid", "transcript_limit");
+    admit("model");
+    const operationId = `model-${record.budgets.modelRequests}`;
+    emit({ type: "model_requested", operationId });
+    let response;
+    let modelCompleted = false;
+    try {
+      try {
+        response = await owned(() => target.turn(request, controller.signal), controller.signal, true);
+      } catch (error2) {
+        if (error2 instanceof Stop)
+          throw error2;
+        throw new Stop("failed", "target_error");
+      }
+      if (!safeBoundary(response)) {
+        record.usage.missingRequests++;
+        throw new Stop("invalid", "invalid_response");
+      }
+      const failure2 = failureSchema.safeParse(response);
+      if (failure2.success) {
+        if (failure2.data.tokens && failure2.data.tokens.total === failure2.data.tokens.prompt + failure2.data.tokens.completion && failure2.data.usageAvailable !== false && (failure2.data.usageAvailable === true || failure2.data.tokens.total > 0)) {
+          measuredRequests++;
+          for (const key of ["prompt", "completion", "total"]) {
+            record.usage.reported[key] += failure2.data.tokens[key];
+            if (phase === "preflight")
+              record.usage.preflight[key] += failure2.data.tokens[key];
+          }
+        } else
+          record.usage.missingRequests++;
+        if (failure2.data.rejectedCall) {
+          const rejection = failure2.data.rejectedCall;
+          const denied = rejection.reason === "undeclared_tool";
+          if (denied)
+            record.policy = "denied";
+          admit("tool");
+          const rejectedOperationId = `tool-${record.budgets.toolCalls}`;
+          const tool = getWorkflowTool(rejection.tool)?.id ?? "unknown";
+          emit({
+            type: "tool_requested",
+            operationId: rejectedOperationId,
+            requestedCallIdHash: rejection.requestedCallIdHash,
+            tool
+          });
+          emit({
+            type: "tool_completed",
+            operationId: rejectedOperationId,
+            requestedCallIdHash: rejection.requestedCallIdHash,
+            tool,
+            status: denied ? "denied" : "invalid"
+          });
+          if (denied)
+            throw new Stop("invalid", "policy_denied");
+        }
+        if (failure2.data.code === "timeout")
+          throw new Stop("timeout", "deadline");
+        if (failure2.data.code === "aborted")
+          throw new Stop("cancelled", "cancelled");
+        throw new Stop(failure2.data.status === "unsupported" ? "unsupported" : failure2.data.status === "invalid" ? "invalid" : "failed", failure2.data.code === "tool_use_unsupported" ? "tool_use_unsupported" : failure2.data.status === "invalid" ? "invalid_response" : "target_error");
+      }
+      const parsed = completedSchema.safeParse(response);
+      if (!parsed.success || parsed.data.tokens.total !== parsed.data.tokens.prompt + parsed.data.tokens.completion) {
+        record.usage.missingRequests++;
+        throw new Stop("invalid", "invalid_response");
+      }
+      const value = parsed.data;
+      const measured = value.usageAvailable !== false && (value.usageAvailable === true || value.tokens.total > 0);
+      if (measured) {
+        measuredRequests++;
+        for (const key of ["prompt", "completion", "total"]) {
+          record.usage.reported[key] += value.tokens[key];
+          if (phase === "preflight")
+            record.usage.preflight[key] += value.tokens[key];
+        }
+      } else
+        record.usage.missingRequests++;
+      record.capability.observedModelHash = hash(value.model);
+      record.capability.observedModel = identity(value.model);
+      const calls = value.message.tool_calls ?? [];
+      if (value.finishReason === "tool_calls" && !calls.length || calls.length && value.finishReason && value.finishReason !== "tool_calls")
+        throw new Stop("invalid", "invalid_response");
+      for (const call of calls) {
+        if (ids.has(call.id))
+          throw new Stop("invalid", "invalid_response");
+        ids.add(call.id);
+      }
+      modelCompleted = true;
+      emit({ type: "model_completed", operationId, status: "completed" });
+      if (budget.max_tokens !== undefined && !measured)
+        throw new Stop("budget_exceeded", "usage_unavailable");
+      if (budget.max_tokens !== undefined && record.usage.reported.total > budget.max_tokens) {
+        record.budgets.tokenOvershoot = record.usage.reported.total - budget.max_tokens;
+        throw new Stop("budget_exceeded", "max_tokens");
+      }
+      active();
+      return value;
+    } finally {
+      if (!modelCompleted)
+        emit({ type: "model_completed", operationId, status: "failed" });
+    }
+  }
+  function originalArguments(call, tools2) {
+    const definition2 = tools2.find((entry) => entry.function.name === call.function.name);
+    if (!definition2) {
+      record.policy = "denied";
+      throw new Stop("invalid", "policy_denied");
+    }
+    let input;
+    try {
+      input = JSON.parse(call.function.arguments);
+    } catch {
+      throw new Stop("invalid", "invalid_response");
+    }
+    if (!isWorkflowState(input) || !ajv3.compile(definition2.function.parameters)(input))
+      throw new Stop("invalid", "invalid_response");
+    return input;
+  }
+  async function probe() {
+    phase = "preflight";
+    const nonce = randomUUID2();
+    const tools2 = [
+      {
+        type: "function",
+        function: {
+          name: "artemis_probe",
+          description: "Echo the exact supplied nonce to verify structured tool protocol.",
+          parameters: {
+            type: "object",
+            properties: { nonce: { const: nonce } },
+            required: ["nonce"],
+            additionalProperties: false
+          }
+        }
+      }
+    ];
+    const messages = [
+      {
+        role: "user",
+        content: `Call artemis_probe once with nonce ${nonce}. After receiving its result, reply with only that nonce.`
+      }
+    ];
+    const first = await model(messages, tools2);
+    const calls = first.message.tool_calls ?? [];
+    if (calls.length !== 1)
+      throw new Stop("unsupported", "preflight_failed");
+    admit("tool");
+    const call = calls[0];
+    originalArguments(call, tools2);
+    const operationId = `tool-${record.budgets.toolCalls}`;
+    const requestedCallIdHash = hash(call.id);
+    emit({ type: "tool_requested", operationId, requestedCallIdHash, tool: "artemis_probe" });
+    messages.push(first.message, {
+      role: "tool",
+      toolCallId: call.id,
+      content: JSON.stringify({ nonce })
+    });
+    emit({
+      type: "tool_completed",
+      operationId,
+      requestedCallIdHash,
+      tool: "artemis_probe",
+      status: "completed"
+    });
+    const second = await model(messages, tools2);
+    if (second.message.tool_calls?.length || second.message.content !== nonce)
+      throw new Stop("unsupported", "preflight_failed");
+    record.capability.preflight = "passed";
+    emit({ type: "preflight_completed", status: "completed" });
+    phase = "execution";
+  }
+  async function executeTool(call, tools2) {
+    if (!workflow || !environment)
+      throw new Stop("failed", "environment_unavailable");
+    admit("tool");
+    const operationId = `tool-${record.budgets.toolCalls}`;
+    const requestedCallIdHash = hash(call.id);
+    const known = getWorkflowTool(call.function.name);
+    emit({
+      type: "tool_requested",
+      operationId,
+      requestedCallIdHash,
+      tool: known?.id ?? "unknown"
+    });
+    let toolCompleted = false;
+    try {
+      const input = originalArguments(call, tools2);
+      if (!workflowToolPermitted(workflow, call.function.name) || !workflowPathAllowed(workflow, call.function.name, input)) {
+        record.policy = "denied";
+        toolCompleted = true;
+        emit({
+          type: "tool_completed",
+          operationId,
+          requestedCallIdHash,
+          tool: known?.id ?? "unknown",
+          status: "denied"
+        });
+        throw new Stop("invalid", "policy_denied");
+      }
+      let value;
+      try {
+        value = await owned(() => environment ? environment.execute({ tool: call.function.name, input: structuredClone(input) }, controller.signal) : Promise.reject(), controller.signal);
+      } catch (error2) {
+        if (error2 instanceof Stop)
+          throw error2;
+        throw new Stop("failed", "tool_failed");
+      }
+      if (!isWorkflowState(value) || !known)
+        throw new Stop("invalid", "invalid_environment");
+      const status = value.status;
+      if (!isWorkflowState(value.evidence) || value.evidence.tool !== known.id || value.evidence.version !== "1" || value.evidence.status !== status || Object.keys(value).some((key) => !(status === "succeeded" ? ["status", "output", "state", "evidence"] : ["status", "code", "evidence"]).includes(key)))
+        throw new Stop("invalid", "invalid_environment");
+      if (status === "succeeded") {
+        if (!isWorkflowState(value.state) || !isWorkflowJson(value.output) || !ajv3.compile(known.outputSchema)(value.output))
+          throw new Stop("invalid", "invalid_environment");
+        state = structuredClone(value.state);
+        transcript.push({
+          role: "tool",
+          toolCallId: call.id,
+          content: JSON.stringify(value.output)
+        });
+        toolCompleted = true;
+        emit({
+          type: "tool_completed",
+          operationId,
+          requestedCallIdHash,
+          tool: known.id,
+          status: "completed"
+        });
+      } else if ((status === "denied" || status === "invalid" || status === "failed") && typeof value.code === "string" && failureCodes.has(value.code)) {
+        if (status === "denied")
+          record.policy = "denied";
+        transcript.push({
+          role: "tool",
+          toolCallId: call.id,
+          content: JSON.stringify({ status, code: value.code })
+        });
+        toolCompleted = true;
+        emit({ type: "tool_completed", operationId, requestedCallIdHash, tool: known.id, status });
+        throw new Stop(status === "denied" ? "invalid" : "failed", status === "denied" ? "policy_denied" : "tool_failed");
+      } else
+        throw new Stop("invalid", "invalid_environment");
+      active();
+    } finally {
+      if (!toolCompleted)
+        emit({
+          type: "tool_completed",
+          operationId,
+          requestedCallIdHash,
+          tool: known?.id ?? "unknown",
+          status: record.policy === "denied" ? "denied" : "failed"
+        });
+    }
+  }
+  async function run() {
+    sessionState = controller.signal.aborted ? "cancelling" : "running";
+    started = Date.now();
+    const timeout = workflow?.environment.policy.budgets.timeout_ms ?? 1;
+    const timer = setTimeout(() => {
+      deadlineExpired = true;
+      abort();
+    }, timeout);
+    const cleanupMs = options.cleanupTimeoutMs ?? (workflow?.environment.type === "sandbox" ? 6000 : 1000);
+    try {
+      if (!workflow)
+        throw new Stop("invalid", "invalid_workflow");
+      if (!Number.isInteger(cleanupMs) || cleanupMs < 1 || cleanupMs > 1e4 || !target || typeof target.turn !== "function" || typeof target.capabilities !== "function")
+        throw new Stop("invalid", "invalid_options");
+      active();
+      emit({ type: "started" });
+      const initialState = options.preflightOnly ? {} : await owned(() => resolveWorkflowInitialState(workflow, options.fixtureRoot), controller.signal).catch((error2) => {
+        if (error2 instanceof Stop)
+          throw error2;
+        throw new Stop("invalid", "invalid_fixture");
+      });
+      active();
+      const advertised = await owned(() => target.capabilities({ timeoutMs: Math.max(1, timeout - (Date.now() - started)) }, controller.signal), controller.signal);
+      if (!safeBoundary(advertised))
+        throw new Stop("invalid", "invalid_response");
+      const capability = capabilitySchema.safeParse(advertised);
+      if (!capability.success)
+        throw new Stop("unsupported", "target_unavailable");
+      record.capability.advertised = capability.data.toolUse;
+      record.capability.transportCancellation = capability.data.transportCancellation;
+      if (!capability.data.toolUse)
+        throw new Stop("unsupported", "tool_use_unsupported");
+      if (options.preflight || options.preflightOnly)
+        await probe();
+      if (!options.preflightOnly) {
+        active();
+        const factory2 = options.environmentFactory ?? (workflow.environment.type === "simulated" ? createSimulatedWorkflowEnvironment : createDockerWorkflowEnvironment);
+        environment = await owned(async () => {
+          const created = await factory2({
+            workflow: structuredClone(workflow),
+            initialState: structuredClone(initialState),
+            signal: controller.signal
+          });
+          environment = created;
+          if (finished && created && typeof created.close === "function") {
+            const lateController = new AbortController;
+            const lateTimer = setTimeout(() => lateController.abort(), Math.min(1000, cleanupMs));
+            try {
+              await owned(() => created.close(lateController.signal), lateController.signal);
+            } catch {} finally {
+              clearTimeout(lateTimer);
+            }
+          }
+          return created;
+        }, controller.signal);
+        if (!environment || environment.type !== workflow.environment.type || typeof environment.execute !== "function" || typeof environment.snapshot !== "function" || typeof environment.close !== "function" || environment.capabilities?.network !== "denied" || environment.capabilities.commands !== "denied" || environment.capabilities.externalSideEffects !== "denied" || environment.capabilities.isolation !== (workflow.environment.type === "simulated" ? "memory" : "container"))
+          throw new Stop("invalid", "invalid_environment");
+        state = structuredClone(initialState);
+        transcript = [{ role: "system", content: workflow.workflow.system_instructions }];
+        const tools2 = workflow.tools.map((id) => {
+          const descriptor2 = getWorkflowTool(id);
+          if (!descriptor2)
+            throw new Stop("invalid", "invalid_workflow");
+          return {
+            type: "function",
+            function: {
+              name: id,
+              description: descriptor2.description,
+              parameters: descriptor2.inputSchema
+            }
+          };
+        });
+        for (const turn of workflow.workflow.turns) {
+          transcript.push(structuredClone(turn));
+          while (true) {
+            const answer = await model(transcript, tools2);
+            transcript.push(answer.message);
+            const calls = answer.message.tool_calls ?? [];
+            if (!calls.length)
+              break;
+            for (const call of calls)
+              await executeTool(call, tools2);
+          }
+        }
+      }
+      record.execution = "completed";
+      record.reason = "finished";
+    } catch (error2) {
+      if (error2 instanceof WorkflowEnvironmentInitializationError) {
+        const detail = error2.cleanup;
+        const checked = safeBoundary(detail) ? cleanupSchema.extend({ pendingOperations: exports_external.number().int().nonnegative().safe() }).safeParse(detail) : null;
+        record.cleanup = checked?.success ? checked.data : { status: "unresolved", artifacts: "unknown", pendingOperations: 1 };
+      }
+      const stop = error2 instanceof WorkflowEnvironmentInitializationError ? new Stop("failed", "environment_unavailable") : error2 instanceof Stop ? error2 : new Stop("failed", "target_error");
+      record.execution = stop.execution;
+      record.reason = stop.reason;
+    } finally {
+      clearTimeout(timer);
+      controller.abort();
+      const cleanup = new AbortController;
+      const drainController = new AbortController;
+      const drainBudget = Math.max(1, Math.floor((Number.isInteger(cleanupMs) && cleanupMs >= 1 && cleanupMs <= 1e4 ? cleanupMs : 1000) / 3));
+      const drainTimer = setTimeout(() => drainController.abort(), drainBudget);
+      let adapterPending = 0;
+      try {
+        const drain = target?.drain;
+        if (typeof drain === "function") {
+          const value = await owned(() => drain.call(target, { timeoutMs: drainBudget }), drainController.signal);
+          if (value && Number.isSafeInteger(value.pendingOperations) && value.pendingOperations >= 0)
+            adapterPending = value.pendingOperations;
+          else
+            adapterPending = 1;
+        }
+        const callbacks = [...pending];
+        if (callbacks.length)
+          await owned(() => Promise.allSettled(callbacks), drainController.signal);
+      } catch {
+        adapterPending = typeof target?.drain === "function" ? Math.max(1, adapterPending) : adapterPending;
+      }
+      clearTimeout(drainTimer);
+      record.usage.inFlightUnknown = modelPending.size > 0 || adapterPending > 0;
+      const pendingBeforeClose = pending.size;
+      if (environment && typeof environment.close === "function") {
+        const snapshotController = new AbortController;
+        const snapshotTimer = setTimeout(() => snapshotController.abort(), drainBudget);
+        if (!pendingBeforeClose && typeof environment.snapshot === "function" && !cleanup.signal.aborted) {
+          try {
+            const snapshot = await owned(() => environment.snapshot(snapshotController.signal), snapshotController.signal);
+            if (isWorkflowState(snapshot))
+              state = structuredClone(snapshot);
+            else
+              state = null;
+          } catch {
+            state = null;
+          }
+        } else
+          state = null;
+        clearTimeout(snapshotTimer);
+        const closeTimer = setTimeout(() => cleanup.abort(), drainBudget);
+        try {
+          const result = await owned(() => environment.close(cleanup.signal), cleanup.signal);
+          const checked = safeBoundary(result) ? cleanupSchema.safeParse(result) : null;
+          if (checked?.success)
+            record.cleanup = { ...checked.data, pendingOperations: 0 };
+          else
+            record.cleanup = { status: "unresolved", artifacts: "unknown", pendingOperations: 0 };
+        } catch {
+          record.cleanup = { status: "unresolved", artifacts: "unknown", pendingOperations: 0 };
+        } finally {
+          clearTimeout(closeTimer);
+        }
+      }
+      record.cleanup.pendingOperations = Math.max(record.cleanup.pendingOperations, pending.size, adapterPending);
+      if (record.cleanup.pendingOperations || pendingBeforeClose || cleanup.signal.aborted) {
+        record.cleanup.status = "unresolved";
+        record.cleanup.artifacts = "unknown";
+      }
+      if (record.cleanup.status === "unresolved")
+        state = null;
+      options.signal?.removeEventListener("abort", abort);
+      record.usage.missingRequests = record.budgets.modelRequests - measuredRequests;
+      const tokenLimit = workflow?.environment.policy.budgets.max_tokens;
+      record.budgets.tokenOvershoot = tokenLimit === undefined ? 0 : Math.max(0, record.usage.reported.total - tokenLimit);
+      record.usage.status = measuredRequests ? record.usage.missingRequests || record.usage.inFlightUnknown ? "partial" : "reported" : "unavailable";
+      if (state) {
+        const files = isWorkflowState(state.files) ? Object.entries(state.files).filter((entry) => typeof entry[1] === "string").sort(([a2], [b2]) => a2.localeCompare(b2)) : [];
+        record.artifacts = {
+          state: "available",
+          stateSha256: hash(JSON.stringify(state)),
+          files: files.slice(0, 100).map(([path, content]) => ({
+            pathSha256: hash(path),
+            contentSha256: hash(content),
+            bytes: Buffer.byteLength(content)
+          })),
+          omittedFiles: Math.max(0, files.length - 100)
+        };
+      }
+      record.budgets.elapsedMs = Math.max(0, Date.now() - started);
+      emit({ type: "finished", status: record.execution === "completed" ? "completed" : "failed" });
+      finished = true;
+      sessionState = "completed";
+      for (const wake of listeners)
+        wake();
+    }
+    return {
+      record: structuredClone(record),
+      state: state ? structuredClone(state) : null,
+      transcript: structuredClone(transcript)
+    };
+  }
+  return {
+    get state() {
+      return sessionState;
+    },
+    run() {
+      if (!promise) {
+        sessionState = controller.signal.aborted ? "cancelling" : "running";
+        promise = Promise.resolve().then(run);
+      }
+      return promise;
+    },
+    cancel: abort,
+    async* events() {
+      let index = 0;
+      while (true) {
+        while (index < retained.length)
+          yield structuredClone(retained[index++]);
+        if (finished)
+          return;
+        await new Promise((resolve4) => {
+          const wake = () => {
+            listeners.delete(wake);
+            resolve4();
+          };
+          listeners.add(wake);
+        });
+      }
+    }
+  };
+}
+function runAgentWorkflow(options) {
+  return createAgentWorkflowSession(options).run();
+}
+// src/validator/validator.ts
+var import_yaml4 = __toESM(require_dist(), 1);
 import { readFileSync } from "node:fs";
 class ScenarioValidator {
   _options;
@@ -34035,12 +35367,12 @@ class ScenarioValidator {
     }
     let parsed;
     try {
-      parsed = import_yaml3.default.parse(content, {
+      parsed = import_yaml4.default.parse(content, {
         prettyErrors: true,
         strict: true
       });
     } catch (err) {
-      if (err instanceof import_yaml3.default.YAMLError) {
+      if (err instanceof import_yaml4.default.YAMLError) {
         const linePos = err.linePos?.[0];
         errors3.push({
           line: linePos?.line || 1,
@@ -34253,14 +35585,19 @@ class ScenarioValidator {
 }
 export {
   wrapError,
+  workflowToolPermitted,
+  workflowPathAllowed,
   validateToolArguments,
   validateScenario,
   validateAgentWorkflow,
+  validWorkflowTranscript,
   substituteVariables,
   substituteString,
   scoreAgentOutcome,
   runScenarios,
   runScenario,
+  runAgentWorkflow,
+  resolveWorkflowInitialState,
   resolveScenarioPaths,
   resolvePatterns,
   registerEvaluator,
@@ -34279,6 +35616,7 @@ export {
   listKnownModels,
   listEvaluators,
   listAdapters,
+  isWorkflowState,
   isWorkflowRelativePath,
   isWorkflowJson,
   isStressManifest,
@@ -34302,19 +35640,26 @@ export {
   createWorkloadIdentity,
   createStorageFromEnv,
   createStorageAdapter,
+  createSimulatedWorkflowEnvironment,
   createRunManifest,
   createRedactionOptions,
   createNoOpRedactor,
   createModelClientTarget,
   createExecutionProvenance,
+  createDockerWorkflowEnvironmentFactory,
+  createDockerWorkflowEnvironment,
   createDefaultRedactor,
+  createAgentWorkflowSession,
   createAdapter,
   assessComparisonEligibility,
   assertRunManifestIntegrity,
+  agentTurnRequestSchema,
   adapterRegistry,
   actionBudgetExceeded,
   WorkflowPolicySchema,
+  WorkflowEnvironmentInitializationError,
   WORKFLOW_TOOL_IDS,
+  WORKFLOW_SANDBOX_IMAGE,
   VariablesSchema,
   ToolTraceEvaluator,
   TestCaseSchema,