@deepseek-ai/dsh-workflow-ptc 0.2.1-alpha.1 → 0.2.1-alpha.3

package/README.i18n.yaml

@@ -21,14 +21,14 @@
   en: 9c31c6e17ba018ed
   zh: 85ffe20ce8a5a371
 /deepseek-ai-dsh-workflow-ptc/use-this-package/results-and-failures:
-  en: 483134c11525910a
-  zh: d2ad48023e4a4be9
+  en: 0626f232df315a7d
+  zh: 573e9a12bc69ac6d
 /deepseek-ai-dsh-workflow-ptc/use-this-package/file-policy-and-cancellation:
-  en: abc56c2117c83d1c
-  zh: 4574a44302f70c20
+  en: 5a13be99e2c2ca39
+  zh: ff16dbe6bc83a75d
 /deepseek-ai-dsh-workflow-ptc/understand-the-implementation:
-  en: 52aee3bea250e968
-  zh: d606ae0fbb5c97b4
+  en: ff9de0f5f3423c12
+  zh: 4c5ae9845d452cc1
 /deepseek-ai-dsh-workflow-ptc/understand-the-implementation/design-concept:
   en: 9b3beda22fb408f7
   zh: ac8701b4a7591b0e
@@ -36,14 +36,14 @@
   en: d94db278c7b67278
   zh: 054d0cf46a8f6f07
 /deepseek-ai-dsh-workflow-ptc/understand-the-implementation/values-and-child-ownership:
-  en: 4e866f00a49d76e7
-  zh: 15a02d9ccc33d08f
+  en: dc06a1e03179824e
+  zh: 4be1d6bc090f4c03
 /deepseek-ai-dsh-workflow-ptc/understand-the-implementation/cancellation-and-outcomes:
   en: 8b8806d701e3d32d
   zh: cfa21c4962be2fa4
 /deepseek-ai-dsh-workflow-ptc/further-exploration:
-  en: 8fa36196dfbb0906
-  zh: 301c6efb8a7dfffe
+  en: 07733b39d2029089
+  zh: a4d54dd2fd7d21d3
 /deepseek-ai-dsh-workflow-ptc/model-experience:
   en: 215e7ba838619b7b
   zh: a311da3843709f90

package/README.md

@@ -50,13 +50,13 @@ The Node PTC provider's `maxPendingCalls` also limits workflow concurrency: chil
 
 ### Results and failures
 
-The script runs with top-level `await`; `meta` and `args` arrive as JSON data. Every `agent()` call uses the configured subagent provider and the run's fixed parent. The final lossless-JSON return value becomes the run result; an ordinary child failure resolves `agent()` to `null`.
+The script runs with top-level `await`; `meta` and `args` arrive as JSON data. Every `agent()` call starts a managed subagent Activation under the run's fixed parent and waits for its text or structured result. The workflow records its own members and collects their results without adding them to the parent's subagent catalog or sending child settlement notices to the parent model. The final lossless-JSON return value becomes the run result; an ordinary child failure resolves `agent()` to `null`.
 
 Invalid metadata, an unparseable body, an unavailable provider route or a per-run cap above the ceiling is rejected before a run is published. During execution, hook misuse and tripped cooperative caps fail the workflow. Process failures, unavailable required confinement and PTC output or control limits also fail the run.
 
 ### File policy and cancellation
 
-The engine resolves the calling Session's standing file policy and cwd for PTC execution. The VM retains the documented helper API, but it is not a security boundary: code that reaches Node remains subject to the selected OS file policy. The program-visible environment is empty. Network access is not restricted by the file policy.
+The engine captures the calling Session's effective working directory and standing file policy separately. The PTC process and every child started by that workflow retain the captured directory when the parent later moves. A runtime without confinement is accepted only for `danger-full-access`; `read-only` and `workspace-write` fail before execution. Node in-memory mode executes an async wrapper in a temporary environment, so workflow-local variables never join the Agent's retained REPL. The VM retains the documented helper API, but it is not a security boundary: code that reaches Node follows the selected runtime's file policy. The program-visible environment is empty. Network access is not restricted by the file policy.
 
 The workflow requests `timeoutMs: null` from PTC. Its initial VM slice still has `syncTimeoutMs`, and a caller's abort signal still applies, including an enclosing tool deadline. Cancellation immediately aborts the PTC process and pending or active subagents. The caller must dispose every run and await child cleanup; there is no separate workflow cleanup timer.
 
@@ -68,7 +68,7 @@ The workflow requests `timeoutMs: null` from PTC. Its initial VM slice still has
 <details>
 <summary>Implementation internals — click to expand</summary>
 
-The workflow engine owns orchestration; the PTC provider owns process launch, OS confinement, framed transport and managed process cleanup.
+The workflow engine owns orchestration; the PTC provider owns process launch, OS confinement, framed transport and managed process cleanup. Local children remain in the parent subagent catalog after completion, independently of caller-owned result collection; workflow runs add no parent completion notice. Local workflow children use the continuable catalog mode and accept messages while resident; cold continuation requires Session persistence and query, so an ephemeral child returns `NOT_RESUMABLE` after disposal.
 
 ### Design concept
 
@@ -90,7 +90,7 @@ One self-contained guest program runs the existing VM and workflow helpers insid
 
 The guest materializes outbound values as lossless JSON before PTC transport. Exotic prototypes, functions, symbols, cycles, sparse arrays, non-finite numbers and nested `undefined` are rejected. Child results cross back as JSON; same-process observer events retain their own cloning and callback-containment rules.
 
-The host tracks pending provider starts separately from published children. A shared abort signal closes both paths; a child that becomes ready after cancellation is disposed. Each published child's disposal is shared by all cleanup paths. In-flight host bindings remain the workflow adapter's responsibility after PTC stops the program.
+The host tracks pending starts separately from accepted Activations. Cancellation aborts pending starts and disposes accepted Activations; a child that becomes ready after cancellation is also disposed. Each Activation's disposal addresses that execution and is shared by all cleanup paths. In-flight host bindings remain the workflow adapter's responsibility after PTC stops the program.
 
 ### Cancellation and outcomes
 
@@ -109,7 +109,7 @@ Use these references for the shared execution guarantees and workflow contracts.
 - [Workflow service](../workflow/README.md) — caller-owned runs and cleanup.
 - [Node PTC runtime](../../ptc-runtime/ptc-runtime-node/README.md) — file policy, process limits and deployment choices.
 - [workflow tool](../tool-workflow/README.md) — model-facing scripted orchestration.
-- [Ralph tool](../tool-ralph/README.md) — opt-in fixed fresh-agent iteration.
+- [Ralph tool](../../experimental/tool-ralph/README.md) — opt-in fixed fresh-agent iteration.
 - [Workflow sandbox reuse](../../../.agents/notes/implemented/architecture/2026-09-13-workflow-ptc-sandbox-reuse.md) — execution ownership and tradeoffs.
 
 -----

package/README.zh.md

@@ -50,13 +50,13 @@ Node PTC 提供方的 `maxPendingCalls` 也限制工作流并发：子 agent 启
 
 ### 结果与失败
 
-脚本支持顶层 `await`；`meta` 和 `args` 作为 JSON 数据传入。每次 `agent()` 调用使用配置的 subagent 提供方及运行固定的父级。最终的无损 JSON 返回值成为运行结果；普通子 agent 失败使 `agent()` 以 `null` 兑现。
+脚本支持顶层 `await`；`meta` 和 `args` 作为 JSON 数据传入。每次 `agent()` 调用都会在本次运行的固定父 agent 下启动受管理的 subagent Activation，并等待其文本或结构化结果。工作流记录自己的成员并收集其结果，不向父级子代理目录添加条目，也不向父模型发送子 agent 结算通知。最终的无损 JSON 返回值成为运行结果；普通子 agent 失败使 `agent()` 以 `null` 兑现。
 
 无效元数据、无法解析的正文、不可用的提供方路由或高于上限的单次运行上限，在运行发布前被拒绝。执行期间，钩子误用与超出协作式上限会使工作流失败。进程失败、所需约束不可用，以及超出 PTC 输出或控制限制也会使运行失败。
 
 ### 文件策略与取消
 
-引擎为 PTC 执行解析调用 Session 的常设文件策略与 cwd。VM 保留文档说明的辅助 API，但它不是安全边界：触达 Node 的代码仍受所选 OS 文件策略约束。程序可见的环境为空。文件策略不限制网络访问。
+引擎分别捕获调用 Session 的有效工作目录与常设文件策略。父级之后切换目录时，PTC 进程及该工作流随后启动的每个子级都保留捕获的目录。不支持文件约束的运行时只允许用于 `danger-full-access`；`read-only` 和 `workspace-write` 在执行前失败。Node 内存保留模式在临时环境中执行异步包装函数，因此工作流局部变量不会进入 Agent 保留的 REPL。VM 保留文档说明的辅助 API，但它不是安全边界：触达 Node 的代码遵循所选运行时的文件策略。程序可见的环境为空。文件策略不限制网络访问。
 
 工作流向 PTC 请求 `timeoutMs: null`。最初的 VM 片段仍受 `syncTimeoutMs` 限制，调用方的中止信号仍然生效，包括外层工具的截止。取消立即中止 PTC 进程及待启动或活跃的 subagent。调用方必须释放每次运行并等待子 agent 清理；不另设工作流清理定时器。
 
@@ -68,7 +68,7 @@ Node PTC 提供方的 `maxPendingCalls` 也限制工作流并发：子 agent 启
 <details>
 <summary>实现细节——点击展开</summary>
 
-工作流引擎负责编排；PTC 提供方负责进程启动、OS 约束、分帧传输与受管进程清理。
+工作流引擎负责编排；PTC 提供方负责进程启动、OS 约束、分帧传输与受管进程清理。本地子级在完成后仍保留于父级 subagent 目录中，与调用方负责的结果收集相互独立；工作流运行不添加父级完成通知。 本地工作流子级使用可续目录模式，驻留时可接收消息；冷续跑需要 Session 持久化与查询，因此临时子级在释放后返回 `NOT_RESUMABLE`。
 
 ### 设计理念
 
@@ -90,7 +90,7 @@ Node PTC 提供方的 `maxPendingCalls` 也限制工作流并发：子 agent 启
 
 guest 在 PTC 传输前将出站值物化为无损 JSON。特殊原型、函数、symbol、循环、稀疏数组、非有限数与嵌套 `undefined` 被拒绝。子 agent 结果以 JSON 返回；同进程观察事件保留自身的克隆和回调异常隔离规则。
 
-Host 分别跟踪待完成的提供方启动与已发布子 agent。共享中止信号关闭这两条路径；取消后才就绪的子 agent 会被释放。每个已发布子 agent 的资源释放由所有清理路径共享。PTC 停止程序后，进行中的 Host 绑定仍由工作流适配器负责。
+Host 分别跟踪待完成的启动与已接受的 Activation。取消会中止待完成的启动并释放已接受的 Activation；取消后才就绪的子 agent 也会被释放。每个 Activation 的资源释放针对该次执行，并由所有清理路径共享。PTC 停止程序后，进行中的 Host 绑定仍由工作流适配器负责。
 
 ### 取消与结果
 
@@ -109,7 +109,7 @@ Host 分别跟踪待完成的提供方启动与已发布子 agent。共享中止
 - [工作流服务](../workflow/README.zh.md)——调用方拥有的运行与清理。
 - [Node PTC 运行时](../../ptc-runtime/ptc-runtime-node/README.zh.md)——文件策略、进程限制与部署选择。
 - [workflow 工具](../tool-workflow/README.zh.md)——面向模型的脚本编排。
-- [Ralph 工具](../tool-ralph/README.zh.md)——需显式启用的固定全新 agent 迭代。
+- [Ralph 工具](../../experimental/tool-ralph/README.zh.md)——需显式启用的固定全新 agent 迭代。
 - [工作流沙箱复用](../../../.agents/notes/implemented/architecture/2026-09-13-workflow-ptc-sandbox-reuse.zh.md)——执行归属与取舍。
 
 -----

package/lib/index.js

@@ -246,6 +246,7 @@ var PtcWorkflowRun = class {
 	cancelReason;
 	disposed;
 	externalAbort;
+	cwd;
 	constructor(ctx, subagents, runtime, id, meta, parent, init, provider, policy, observer, signal) {
 		this.ctx = ctx;
 		this.subagents = subagents;
@@ -263,6 +264,7 @@ var PtcWorkflowRun = class {
 		};
 		if (signal?.aborted) this.externalAbort();
 		else signal?.addEventListener("abort", this.externalAbort, { once: true });
+		this.cwd = ctx.workingDirectory.ensure(parent, this.controller.signal);
 		this.result = Promise.resolve().then(() => this.drive());
 	}
 	/**
@@ -325,18 +327,24 @@ var PtcWorkflowRun = class {
 	async startChild(request) {
 		this.requireActive();
 		const callId = ++this.started;
-		const run = await this.subagents.start(this.provider, {
-			prompt: [{
-				type: "text",
-				text: request.prompt
-			}],
-			parent: this.parent,
+		const run = await this.subagents.startActivation({
+			provider: this.provider,
+			label: `${this.meta.name} child ${callId}`,
+			delivery: "caller",
 			signal: this.controller.signal,
-			...request.schema === void 0 ? {} : { outputSchema: request.schema },
-			...request.provider === void 0 && request.model === void 0 ? {} : { agentOptions: {
-				...request.provider === void 0 ? {} : { provider: request.provider },
-				...request.model === void 0 ? {} : { model: request.model }
-			} }
+			request: {
+				cwd: await this.cwd,
+				prompt: [{
+					type: "text",
+					text: request.prompt
+				}],
+				parent: this.parent,
+				...request.schema === void 0 ? {} : { outputSchema: request.schema },
+				...request.provider === void 0 && request.model === void 0 ? {} : { agentOptions: {
+					...request.provider === void 0 ? {} : { provider: request.provider },
+					...request.model === void 0 ? {} : { model: request.model }
+				} }
+			}
 		});
 		const record = {
 			callId,
@@ -349,7 +357,7 @@ var PtcWorkflowRun = class {
 		}
 		return {
 			callId,
-			childId: run.id
+			childId: run.childId
 		};
 	}
 	async childResult(record) {
@@ -414,14 +422,17 @@ var PtcWorkflowRun = class {
 	async drive() {
 		let result;
 		try {
+			const cwd = await this.cwd;
+			this.requireActive();
+			if (this.runtime.sandboxMode === void 0 && this.policy.mode !== "danger-full-access") throw new Error(`workflow runtime cannot enforce the ${this.policy.mode} file policy`);
 			const outcome = await this.runtime.run(this.runtime.resolve({
-				program: PROGRAM,
+				program: this.runtime.programFormat === "repl" ? `await (async () => {\n${PROGRAM}\n})()` : PROGRAM,
 				bindings: [{
 					global: "workflowHost",
 					functions: this.bindings()
 				}],
-				cwd: this.policy.workspaceRoot,
-				sandboxPolicy: this.policy,
+				cwd,
+				...this.runtime.sandboxMode === void 0 ? {} : { sandboxPolicy: this.policy },
 				timeoutMs: null,
 				signal: this.controller.signal
 			}));
@@ -580,7 +591,8 @@ var PtcWorkflowEngine = class extends WorkflowEngine {
 	static inject = [
 		"subagents",
 		"ptcRuntime",
-		"sandboxPolicy"
+		"sandboxPolicy",
+		"workingDirectory"
 	];
 	static Config = z.object({
 		provider: z.string().default("spawn"),

package/lib/types/host.d.ts

@@ -34,6 +34,7 @@ export declare class PtcWorkflowRun implements WorkflowRun {
     private cancelReason;
     private disposed;
     private readonly externalAbort;
+    private readonly cwd;
     constructor(ctx: Context, subagents: SubagentRuntime, runtime: PtcRuntime, id: WorkflowRunId, meta: WorkflowMeta, parent: Agent, init: WorkerInit, provider: string, policy: SandboxExecutionPolicy, observer: ExecutionObserver, signal?: AbortSignal | undefined);
     /**
      * Stop the script and abort pending and published children.

package/locale/en.json

@@ -0,0 +1,5 @@
+{
+  "meta": {
+    "title": "workflow-ptc"
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "工作流执行引擎",
+    "description": "使用共享的 PTC 运行时执行工作流编排代码。"
+  }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-workflow-ptc",
   "description": "Workflow orchestration in the shared sandboxed Node PTC runtime",
-  "version": "0.2.1-alpha.1",
+  "version": "0.2.1-alpha.3",
   "publishConfig": {
     "access": "public"
   },
@@ -19,53 +19,58 @@
       "default": "./lib/index.js"
     },
     "./src/*": "./src/*",
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./locale/*.json": "./locale/*.json"
   },
   "files": [
+    "locale/*.json",
     "lib/index.js",
     "lib/types/**/*.d.ts"
   ],
   "license": "MIT",
   "peerDependencies": {
-    "@deepseek-ai/dsh-llm": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-agent": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-session": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-tools": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-subagent": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-workflow": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-ptc-runtime": "0.2.1-alpha.1",
-    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.1"
+    "@deepseek-ai/cordis": "~4.0.5-alpha.2",
+    "@deepseek-ai/dsh-agent": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-llm": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-session": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-subagent": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-tools": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-workflow": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-ptc-runtime": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-working-directory": "0.2.1-alpha.3"
   },
   "dependencies": {
-    "@deepseek-ai/dsh-util-values": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-brand": "0.2.1-alpha.1",
-    "@deepseek-ai/schemastery": "~3.18.5-alpha.1"
+    "@deepseek-ai/dsh-brand": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-util-values": "0.2.1-alpha.3",
+    "@deepseek-ai/schemastery": "~3.18.5-alpha.2"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-llm-deepseek-api-key": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-agent": "0.2.1-alpha.1",
-    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
-    "@deepseek-ai/dsh-agent-loop-testkit": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-agent-loop": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-llm": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-session": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-session-projection": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-subagent": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-subagent-spawn-in-process": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-tools": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-workflow": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-system-prompt": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-http-proxy": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-ptc-runtime": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-ptc-runtime-node": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-fs": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-fs-local": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-subprocess": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-subprocess-local": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-sandbox-local": "0.2.1-alpha.1"
+    "@deepseek-ai/dsh-llm-deepseek-api-key": "0.2.1-alpha.3",
+    "@deepseek-ai/cordis": "~4.0.5-alpha.2",
+    "@deepseek-ai/dsh-agent": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-agent-loop": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-agent-loop-testkit": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-llm": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-session": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-session-projection": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-subagent": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-subagent-spawn-in-process": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-system-prompt": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-tools": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-workflow": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-http-proxy": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-ptc-runtime": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-ptc-runtime-node": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-fs": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-fs-local": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-subprocess-local": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-sandbox-local": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-session-persistence-jsonl": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-working-directory": "0.2.1-alpha.3"
   }
 }