@effect-agent/platform-cloudflare 0.1.0-beta.13 → 0.1.0-beta.131

package/src/{code-mode-executor.ts → CloudflareCodeMode.ts}

@@ -1,3 +1,5 @@
+import { RpcTarget } from "cloudflare:workers";
+import { Clock, Duration, Effect, Exit, Fiber, Layer, Option, Queue, Schema } from "effect";
 import {
   CodeExecutionHost,
   CodeExecutionResourceUse,
@@ -14,60 +16,54 @@ import {
   CodeOutputLimitError,
   CodeProgramFailedError,
   CodeSourceError,
-  SandboxImplementation,
   type CodeExecutorExecute,
   type CodeExecutionRequest,
-} from "@effect-agent/sandbox";
-import { WorkerEntrypoint } from "cloudflare:workers";
-import { Cause, Duration, Effect, Exit, Fiber, Layer, Option, Schema } from "effect";
+} from "effect-agent/code-executor";
+import { SandboxImplementation } from "effect-agent/sandbox";
+
+import { safeCauseDiagnostic, safeCauseMessage } from "./internal/boundary.ts";
 
 /**
  * The Cloudflare Dynamic Worker `CodeExecutor` adapter (C4 of ADR-0017;
  * DEPLOY-011). Each pass loads one fresh Worker through the Worker Loader
  * with `globalOutbound: null`, so generated code has no ambient network,
- * bindings, or secrets; its only authority is the pass-scoped host stub that
- * routes back to `CodeModeHostEntrypoint` and, from there, into the pass's
- * `CodeExecutionHost` service. Platform CPU limits stop synchronous runaway
- * programs; the executor-owned wall-clock deadline interrupts asynchronously
- * suspended passes. Deployment class `E` only: the adapter records no
- * persistent state and a later pass may run in a completely different
- * isolate.
+ * bindings, or secrets; its only authority is the pass-scoped RPC target that
+ * routes back into the owning event's `CodeExecutionHost` service. Platform
+ * CPU limits stop synchronous runaway programs; the executor-owned wall-clock
+ * deadline interrupts asynchronously suspended passes. Deployment class `E`
+ * only: the adapter records no persistent state and a later pass may run in a
+ * completely different isolate.
  */
 export const dynamicWorkerImplementation = SandboxImplementation.make({
   isolation: "isolated",
   identity: "cloudflare-dynamic-worker",
 });
 
-/** The narrow host stub the dynamic worker receives (Workers RPC). */
-export interface CodeModeHostStub {
-  readonly call: (passId: string, hostCall: unknown) => Promise<unknown>;
+interface CodeModePassHost extends Rpc.RpcTargetBranded {
+  readonly call: (hostCall: unknown) => Promise<unknown>;
 }
 
-interface RegisteredPass {
-  readonly dispatch: (hostCall: unknown) => Promise<unknown>;
+interface CodeModeHarnessEntrypoint extends Rpc.WorkerEntrypointBranded {
+  readonly run: (host: CodeModePassHost) => Promise<unknown>;
 }
 
 /**
- * Live passes by identity. Entries are Scope-managed: registered when a pass
- * opens and removed by its finalizer, so a stale harness (or a forged
- * `passId`) cannot reach any host authority.
+ * One object-capability endpoint for one execution pass. Workers RPC invokes
+ * the target in the request context where it was created, so the native
+ * Promise returned by `dispatch` and the Effect fiber that settles it share
+ * one I/O owner. Passing the target as `run()`'s argument also scopes the
+ * remote stub to that RPC call; no request state lives at module scope.
  */
-const passRegistry = new Map<string, RegisteredPass>();
+class CodeModePassHostTarget extends RpcTarget implements CodeModePassHost {
+  readonly #dispatch: (hostCall: unknown) => Promise<unknown>;
 
-/**
- * The host-side RPC target for dynamic workers. The application exposes it
- * from its Worker entry (`export { CodeModeHostEntrypoint }`) and hands the
- * adapter a same-instance stub — `ctx.exports.CodeModeHostEntrypoint()` in
- * production (a self service binding may reach a different instance and must
- * not be used there); tests bind it through Miniflare's `kCurrentWorker`.
- */
-export class CodeModeHostEntrypoint extends WorkerEntrypoint {
-  async call(passId: unknown, hostCall: unknown): Promise<unknown> {
-    const pass = passRegistry.get(String(passId));
-    if (pass === undefined) {
-      throw new Error("Unknown Code Mode pass");
-    }
-    return pass.dispatch(hostCall);
+  constructor(dispatch: (hostCall: unknown) => Promise<unknown>) {
+    super();
+    this.#dispatch = dispatch;
+  }
+
+  call(hostCall: unknown): Promise<unknown> {
+    return this.#dispatch(hostCall);
   }
 }
 
@@ -103,9 +99,8 @@ const safeJson = (value) => {
 };
 
 export default class CodeModeHarness extends WorkerEntrypoint {
-  async run() {
-    const config = JSON.parse(this.env.CODE_MODE_PASS);
-    const host = this.env.CODE_MODE_HOST;
+  async run(host) {
+    const config = this.env.CODE_MODE_PASS;
     const limits = config.limits;
     const logs = [];
     let logBytes = 0;
@@ -143,7 +138,7 @@ export default class CodeModeHarness extends WorkerEntrypoint {
         };
         throw new Error("code-mode host-call argument limit exceeded");
       }
-      const outcome = await host.call(config.passId, {
+      const outcome = await host.call({
         namespace,
         method,
         argument: JSON.parse(argText),
@@ -227,55 +222,50 @@ const BoundedLogs = Schema.Array(Schema.String.check(Schema.isMaxLength(16 * 102
   Schema.isMaxLength(4_096),
 );
 
-const HarnessCompleted = Schema.Struct({
-  _tag: Schema.Literal("completed"),
+const HarnessCompleted = Schema.TaggedStruct("completed", {
   value: Schema.Json,
   logs: BoundedLogs,
   hostCalls: Schema.Natural,
   logBytes: Schema.Natural,
   resultBytes: Schema.Natural,
 });
-const HarnessSourceInvalid = Schema.Struct({
-  _tag: Schema.Literal("source-invalid"),
-  message: Schema.String,
-});
-const HarnessNotAFunction = Schema.Struct({
-  _tag: Schema.Literal("source-not-a-function"),
+
+const HarnessNotAFunction = Schema.TaggedStruct("source-not-a-function", {
   actual: Schema.String,
 });
-const HarnessProgramFailed = Schema.Struct({
-  _tag: Schema.Literal("program-failed"),
+
+const HarnessProgramFailed = Schema.TaggedStruct("program-failed", {
   reason: Schema.Literals(["threw", "rejected", "non-json-result"]),
   thrown: Schema.Json,
   message: Schema.String,
   logs: BoundedLogs,
 });
-const HarnessLogLimit = Schema.Struct({
-  _tag: Schema.Literal("log-limit"),
+
+const HarnessLogLimit = Schema.TaggedStruct("log-limit", {
   observed: Schema.Natural,
   logs: BoundedLogs,
 });
-const HarnessArgumentLimit = Schema.Struct({
-  _tag: Schema.Literal("argument-limit"),
+
+const HarnessArgumentLimit = Schema.TaggedStruct("argument-limit", {
   observed: Schema.Natural,
   logs: BoundedLogs,
 });
-const HarnessResultLimit = Schema.Struct({
-  _tag: Schema.Literal("result-limit"),
+
+const HarnessResultLimit = Schema.TaggedStruct("result-limit", {
   observed: Schema.Natural,
   logs: BoundedLogs,
 });
-const HarnessHostCallLimit = Schema.Struct({
-  _tag: Schema.Literal("host-call-limit"),
+
+const HarnessHostCallLimit = Schema.TaggedStruct("host-call-limit", {
   logs: BoundedLogs,
 });
-const HarnessProtocol = Schema.Struct({
-  _tag: Schema.Literal("protocol"),
+
+const HarnessProtocol = Schema.TaggedStruct("protocol", {
   message: Schema.String,
 });
+
 const HarnessOutcome = Schema.Union([
   HarnessCompleted,
-  HarnessSourceInvalid,
   HarnessNotAFunction,
   HarnessProgramFailed,
   HarnessLogLimit,
@@ -285,6 +275,25 @@ const HarnessOutcome = Schema.Union([
   HarnessProtocol,
 ]);
 
+const HarnessPassConfig = Schema.Struct({
+  namespaces: Schema.Array(
+    Schema.Struct({
+      name: Schema.NonEmptyString,
+      methods: Schema.Array(Schema.NonEmptyString).check(Schema.isMaxLength(64)),
+    }),
+  ).check(Schema.isMaxLength(32)),
+  limits: Schema.Struct({
+    maxLogBytes: Schema.Natural,
+    maxResultBytes: Schema.Natural,
+    maxHostCalls: Schema.Natural,
+    maxHostCallArgumentBytes: Schema.Natural,
+  }),
+});
+
+const encodeHarnessPassConfig = Schema.encodeSync(HarnessPassConfig);
+const encodeJsonPayload = Schema.encodeSync(Schema.fromJsonString(Schema.Json));
+const decodeJsonPayload = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Json));
+
 const decodeHarnessOutcome = (value: unknown) => {
   try {
     return Schema.decodeUnknownOption(HarnessOutcome)(value);
@@ -309,6 +318,28 @@ const decodeHostCallResult = (value: unknown) => {
   }
 };
 
+/** Dispose a Cloudflare RPC handle when the runtime supplies its untyped disposal hook. @internal */
+export const disposeRpcHandle = (handle: unknown): Effect.Effect<void> =>
+  Effect.try({
+    try: () => {
+      if ((typeof handle !== "object" && typeof handle !== "function") || handle === null) return;
+      if (!(Symbol.dispose in handle)) return;
+      const dispose = Reflect.get(handle, Symbol.dispose);
+
+      if (typeof dispose === "function") {
+        Reflect.apply(dispose, handle, []);
+      }
+    },
+    catch: (cause) =>
+      safeCauseDiagnostic(cause, "The Cloudflare RPC disposal hook failed without a diagnostic"),
+  }).pipe(
+    Effect.catch((diagnostic) =>
+      Effect.logWarning(`Cloudflare RPC handle disposal failed: ${diagnostic}`).pipe(
+        Effect.ignoreCause,
+      ),
+    ),
+  );
+
 /**
  * Project a host outcome to the plain JSON envelope the harness reads. A
  * `CodeExecutionHost` may return either real `CodeHostCallResult` instances
@@ -326,8 +357,8 @@ const encodeHostResultPayload = (
 ): EncodedHostResultPayload | undefined => {
   try {
     const payload = outcome._tag === "CodeHostCallSuccess" ? outcome.value : outcome.error;
-    const encodedPayload = JSON.stringify(payload);
-    if (encodedPayload === undefined) return undefined;
+    const encodedPayload = encodeJsonPayload(payload);
+
     return {
       encodedPayload,
       resultBytes: utf8ByteLength(encodedPayload),
@@ -339,30 +370,31 @@ const encodeHostResultPayload = (
 
 const utf8ByteLength = (value: string): number => {
   let total = 0;
+
   for (const character of value) {
     const codePoint = character.codePointAt(0) ?? 0;
+
     total += codePoint <= 0x7f ? 1 : codePoint <= 0x7ff ? 2 : codePoint <= 0xffff ? 3 : 4;
   }
+
   return total;
 };
 
-type HostDispatchFailure =
-  | { readonly _tag: "host-call-limit" }
-  | { readonly _tag: "host-call-result-limit"; readonly observed: number }
-  | { readonly _tag: "host-call-protocol" }
-  | { readonly _tag: "wall-clock-timeout" }
-  | { readonly _tag: "host-call-defect"; readonly cause: Cause.Cause<never> };
-
 interface QueuedHostCall {
   readonly call: CodeHostCall;
   readonly resolve: (value: unknown) => void;
   readonly reject: (reason: unknown) => void;
 }
 
-interface ActiveHostCall {
-  readonly fiber: Fiber.Fiber<Record<string, unknown>, never>;
-  readonly settlement: Promise<void>;
-}
+type HostWork =
+  | { readonly _tag: "call"; readonly queued: QueuedHostCall }
+  | { readonly _tag: "limit" };
+
+type HostDispatchError =
+  | CodeExecutionTimeoutError
+  | CodeOutputLimitError
+  | CodeExecutionProtocolError
+  | CodeHostCallLimitError;
 
 /** Reserved global names the harness owns inside the dynamic worker. */
 const reservedHarnessGlobals = new Set(["console"]);
@@ -370,19 +402,14 @@ const reservedHarnessGlobals = new Set(["console"]);
 export interface DynamicWorkerCodeExecutorOptions {
   /** The `worker_loader` binding. */
   readonly loader: WorkerLoader;
-  /**
-   * A SAME-INSTANCE stub of `CodeModeHostEntrypoint`. In production create it
-   * with `ctx.exports.CodeModeHostEntrypoint()`; a cross-instance stub would
-   * dispatch host calls into an isolate without this pass's registry entry.
-   */
-  readonly hostStub: CodeModeHostStub;
   /** Compatibility date for dynamic workers; defaults to `2025-05-01`. */
   readonly compatibilityDate?: string | undefined;
 }
 
-const passCounterState = { next: 0 };
-
-const makeExecute = (options: DynamicWorkerCodeExecutorOptions): CodeExecutorExecute =>
+const makeExecute = (
+  options: DynamicWorkerCodeExecutorOptions,
+  clock: Clock.Clock,
+): CodeExecutorExecute =>
   Effect.fn("DynamicWorkerCodeExecutor.execute")(function* (request: CodeExecutionRequest) {
     if (request.network._tag !== "NetworkDisabled") {
       return yield* CodeExecutorUnsupportedError.make({
@@ -393,6 +420,7 @@ const makeExecute = (options: DynamicWorkerCodeExecutorOptions): CodeExecutorExe
       });
     }
     const sourceBytes = utf8ByteLength(request.source);
+
     if (sourceBytes > request.limits.maxSourceBytes) {
       return yield* CodeSourceError.make({
         implementation: dynamicWorkerImplementation,
@@ -409,148 +437,140 @@ const makeExecute = (options: DynamicWorkerCodeExecutorOptions): CodeExecutorExe
         });
       }
     }
-
     const host = yield* CodeExecutionHost;
-    passCounterState.next += 1;
-    // The pass id is the only credential a loaded program presents to reach
-    // its host authority, so it must be unguessable: a program cannot forge
-    // another pass's id even if two passes were ever concurrent (the broker
-    // keeps them sequential, but the id must not rely on that). The counter
-    // prefix keeps ids debuggable; the random suffix makes them unforgeable.
-    const passId = `code-mode-pass-${passCounterState.next}-${crypto.randomUUID()}`;
-
-    const startedAt = performance.now();
-    const passDeadline = startedAt + Duration.toMillis(request.limits.maxWallTime);
-    const remainingPassWallTime = (): Duration.Duration =>
-      Duration.millis(Math.max(0, passDeadline - performance.now()));
+
+    // This synchronous clock access is confined to callbacks that must compute a timeout
+    // immediately. The Clock service remains the authority, so tests and hosts can replace it.
+    const startedAt = clock.monotonicTimeNanosUnsafe();
+    const passDeadline = startedAt + Duration.toNanosUnsafe(request.limits.maxWallTime);
+
+    const remainingPassWallTime = (): Duration.Duration => {
+      const now = clock.monotonicTimeNanosUnsafe();
+
+      return Duration.nanos(passDeadline > now ? passDeadline - now : 0n);
+    };
+
     let issuedHostCalls = 0;
     let passOpen = true;
     const queuedHostCalls: Array<QueuedHostCall> = [];
-    let activeHostCall: ActiveHostCall | undefined;
-    let hostDispatchFailure: HostDispatchFailure | undefined;
-    let propagatedHostDispatchFailure: HostDispatchFailure | undefined;
-    let signalHostDispatchFailure = (_failure: HostDispatchFailure): void => undefined;
-    const hostDispatchFailureSignal = new Promise<HostDispatchFailure>((resolve) => {
-      signalHostDispatchFailure = resolve;
-    });
+    let passFailure: HostDispatchError | undefined;
+
+    const failPass = (error: HostDispatchError): void => {
+      if (passFailure === undefined) passFailure = error;
+    };
+
     const rejectQueuedHostCalls = (reason: Error): void => {
       for (const queued of queuedHostCalls.splice(0)) {
         queued.reject(reason);
       }
     };
-    const recordHostDispatchFailure = (failure: HostDispatchFailure): void => {
-      if (hostDispatchFailure !== undefined) return;
-      hostDispatchFailure = failure;
-      signalHostDispatchFailure(failure);
-      rejectQueuedHostCalls(new Error("Code Mode pass failed"));
-    };
-    const failHostDispatch = (failure: HostDispatchFailure) => {
-      switch (failure._tag) {
-        case "host-call-limit":
-          return Effect.fail(
-            CodeHostCallLimitError.make({
-              implementation: dynamicWorkerImplementation,
-              limit: request.limits.maxHostCalls,
-              logs: [],
-            }),
-          );
-        case "host-call-result-limit":
-          return Effect.fail(
-            CodeOutputLimitError.make({
-              implementation: dynamicWorkerImplementation,
-              surface: "host-call-result",
-              limit: request.limits.maxHostCallResultBytes,
-              observed: failure.observed,
-              logs: [],
-            }),
-          );
-        case "host-call-protocol":
-          return Effect.fail(
-            CodeExecutionProtocolError.make({
-              implementation: dynamicWorkerImplementation,
-              message: "The execution host returned a value outside the CodeHostCallResult schema",
-            }),
-          );
-        case "wall-clock-timeout":
-          return Effect.fail(
-            CodeExecutionTimeoutError.make({
-              implementation: dynamicWorkerImplementation,
-              kind: "wall-clock",
-              maxWallTime: request.limits.maxWallTime,
-              logs: [],
-            }),
-          );
-        case "host-call-defect":
-          return Effect.failCause(failure.cause);
-      }
-    };
-    const propagateHostDispatchFailure = (failure: HostDispatchFailure) =>
+
+    const queue = yield* Queue.unbounded<HostWork>();
+
+    const deliverHostOutcome = (
+      queued: QueuedHostCall,
+      outcome: CodeHostCallResult,
+    ): Effect.Effect<void, CodeExecutionProtocolError | CodeOutputLimitError> =>
       Effect.gen(function* () {
-        propagatedHostDispatchFailure = failure;
-        return yield* failHostDispatch(failure);
+        const decoded = decodeHostCallResult(outcome);
+
+        if (Option.isNone(decoded)) {
+          const error = CodeExecutionProtocolError.make({
+            implementation: dynamicWorkerImplementation,
+            message: "The execution host returned a value outside the CodeHostCallResult schema",
+          });
+
+          failPass(error);
+
+          return yield* error;
+        }
+        const encoded = encodeHostResultPayload(decoded.value);
+
+        if (encoded === undefined || encoded.resultBytes > request.limits.maxHostCallResultBytes) {
+          const error = CodeOutputLimitError.make({
+            implementation: dynamicWorkerImplementation,
+            surface: "host-call-result",
+            limit: request.limits.maxHostCallResultBytes,
+            observed: encoded?.resultBytes ?? 0,
+            logs: [],
+          });
+
+          failPass(error);
+
+          return yield* error;
+        }
+        const normalizedPayload = decodeJsonPayload(encoded.encodedPayload);
+
+        if (Option.isNone(normalizedPayload)) {
+          const error = CodeExecutionProtocolError.make({
+            implementation: dynamicWorkerImplementation,
+            message: "The execution host returned a result that could not cross the JSON boundary",
+          });
+
+          failPass(error);
+
+          return yield* error;
+        }
+        queued.resolve(
+          decoded.value._tag === "CodeHostCallSuccess"
+            ? { _tag: "CodeHostCallSuccess", value: normalizedPayload.value }
+            : { _tag: "CodeHostCallFailure", error: normalizedPayload.value },
+        );
       });
 
-    const startNextHostCall = (): void => {
-      if (!passOpen || hostDispatchFailure !== undefined || activeHostCall !== undefined) return;
-      const queued = queuedHostCalls.shift();
-      if (queued === undefined) return;
-
-      // A Dynamic Worker callback is a new Workers RPC into the loader isolate. Running the
-      // complete host call on an independent root fiber breaks its dependency on the still-open
-      // guest RPC. Retaining the handle and starting one call at a time preserves bounded,
-      // serialized execution and lets pass teardown interrupt and await the active call.
-      const fiber = Effect.runFork(
-        Effect.yieldNow.pipe(
-          Effect.andThen(host.call(queued.call)),
+    // Workers RPC into the loader isolate cannot settle on the fiber blocked
+    // in `entrypoint.run()`. A Scope-owned sibling fiber keeps that
+    // independence while inheriting the pass Context and dying with the Scope.
+    const serveHostCalls = Effect.gen(function* () {
+      while (true) {
+        const work = yield* Queue.take(queue);
+
+        if (work._tag === "limit") {
+          const error = CodeHostCallLimitError.make({
+            implementation: dynamicWorkerImplementation,
+            limit: request.limits.maxHostCalls,
+            logs: [],
+          });
+
+          failPass(error);
+
+          return yield* error;
+        }
+        const queued = work.queued;
+
+        yield* host.call(queued.call).pipe(
           Effect.timeoutOrElse({
             duration: remainingPassWallTime(),
-            orElse: () =>
-              Effect.sync(() => {
-                recordHostDispatchFailure({ _tag: "wall-clock-timeout" });
-                throw new Error("code-mode host call exceeded the pass wall-clock limit");
-              }),
-          }),
-          Effect.map((outcome) => {
-            const decoded = decodeHostCallResult(outcome);
-            if (Option.isNone(decoded)) {
-              recordHostDispatchFailure({ _tag: "host-call-protocol" });
-              throw new Error("host-call protocol violation");
-            }
-            const encoded = encodeHostResultPayload(decoded.value);
-            if (
-              encoded === undefined ||
-              encoded.resultBytes > request.limits.maxHostCallResultBytes
-            ) {
-              recordHostDispatchFailure({
-                _tag: "host-call-result-limit",
-                observed: encoded?.resultBytes ?? 0,
+            orElse: () => {
+              const error = CodeExecutionTimeoutError.make({
+                implementation: dynamicWorkerImplementation,
+                kind: "wall-clock",
+                maxWallTime: request.limits.maxWallTime,
+                logs: [],
               });
-              throw new Error("host-call result limit exceeded");
-            }
-            const normalizedPayload: unknown = JSON.parse(encoded.encodedPayload);
-            return decoded.value._tag === "CodeHostCallSuccess"
-              ? { _tag: "CodeHostCallSuccess", value: normalizedPayload }
-              : { _tag: "CodeHostCallFailure", error: normalizedPayload };
+
+              failPass(error);
+
+              return error;
+            },
           }),
-        ),
-      );
-      const settlement = Effect.runPromise(Fiber.await(fiber))
-        .then((exit) => {
-          if (Exit.isSuccess(exit)) {
-            queued.resolve(exit.value);
-            return;
-          }
-          if (!Cause.hasInterruptsOnly(exit.cause)) {
-            recordHostDispatchFailure({ _tag: "host-call-defect", cause: exit.cause });
-          }
-          queued.reject(new Error("Code Mode host call failed"));
-        })
-        .finally(() => {
-          if (activeHostCall?.fiber === fiber) activeHostCall = undefined;
-          startNextHostCall();
-        });
-      activeHostCall = { fiber, settlement };
-    };
+          Effect.flatMap((outcome) => deliverHostOutcome(queued, outcome)),
+          Effect.tapError(() =>
+            Effect.sync(() => queued.reject(new Error("Code Mode host call failed"))),
+          ),
+          Effect.onInterrupt(() =>
+            Effect.sync(() => queued.reject(new Error("Code Mode pass is closing"))),
+          ),
+        );
+      }
+    });
+
+    const concurrency = request.limits.maxHostCallConcurrency ?? 4;
+
+    const server = yield* Effect.all(
+      Array.from({ length: concurrency }, () => serveHostCalls),
+      { concurrency, discard: true },
+    ).pipe(Effect.andThen(Effect.never), Effect.forkScoped);
 
     const dispatch = (hostCall: unknown): Promise<unknown> => {
       if (!passOpen) {
@@ -558,67 +578,51 @@ const makeExecute = (options: DynamicWorkerCodeExecutorOptions): CodeExecutorExe
       }
       issuedHostCalls += 1;
       if (issuedHostCalls > request.limits.maxHostCalls) {
-        recordHostDispatchFailure({ _tag: "host-call-limit" });
+        const error = CodeHostCallLimitError.make({
+          implementation: dynamicWorkerImplementation,
+          limit: request.limits.maxHostCalls,
+          logs: [],
+        });
+
+        failPass(error);
+        Queue.offerUnsafe(queue, { _tag: "limit" });
+
         return Promise.reject(new Error("host-call limit exceeded"));
       }
       const decoded = decodeHostCall(hostCall);
+
       if (Option.isNone(decoded)) {
         return Promise.reject(new TypeError("host calls must match the CodeHostCall schema"));
       }
+
       return new Promise((resolve, reject) => {
-        queuedHostCalls.push({ call: decoded.value, resolve, reject });
-        startNextHostCall();
+        const queued = { call: decoded.value, resolve, reject };
+
+        queuedHostCalls.push(queued);
+        Queue.offerUnsafe(queue, { _tag: "call", queued });
       });
     };
 
-    const closeHostDispatch = Effect.gen(function* () {
+    const closeAdmission = Effect.sync(() => {
       passOpen = false;
-      passRegistry.delete(passId);
       rejectQueuedHostCalls(new Error("Code Mode pass is closing"));
-      const active = activeHostCall;
-      if (active !== undefined) {
-        yield* Fiber.interrupt(active.fiber);
-        yield* Effect.promise(() => active.settlement);
-        if (activeHostCall === active) activeHostCall = undefined;
-      }
-      return hostDispatchFailure;
     });
-    const stopHostDispatch = closeHostDispatch.pipe(
-      Effect.flatMap((failure) =>
-        failure !== undefined && propagatedHostDispatchFailure !== failure
-          ? propagateHostDispatchFailure(failure)
-          : Effect.void,
-      ),
-    );
-    const releaseHostDispatch = closeHostDispatch.pipe(
-      Effect.flatMap((failure) => {
-        if (failure?._tag !== "host-call-defect" || propagatedHostDispatchFailure === failure) {
-          return Effect.void;
-        }
-        propagatedHostDispatchFailure = failure;
-        return Effect.failCause(failure.cause);
-      }),
-    );
 
-    yield* Effect.acquireRelease(
-      Effect.sync(() => {
-        passRegistry.set(passId, { dispatch });
-      }),
-      () => releaseHostDispatch,
-    );
+    yield* Effect.addFinalizer(() => closeAdmission.pipe(Effect.andThen(Fiber.interrupt(server))));
 
-    const workerCode = {
+    // No `allowExperimental`: the runtime only accepts it when the CALLING
+    // worker carries the `experimental` compatibility flag, which deployed
+    // consumers cannot set — the option would reject every pass in
+    // production. The harness needs no experimental runtime features.
+    const workerCode: WorkerLoaderWorkerCode = {
       compatibilityDate: options.compatibilityDate ?? "2025-05-01",
-      allowExperimental: true,
       mainModule: "harness.js",
       modules: {
         "harness.js": HARNESS_MODULE,
         "program.js": `export default (\n${request.source}\n);`,
       },
       env: {
-        CODE_MODE_HOST: options.hostStub,
-        CODE_MODE_PASS: JSON.stringify({
-          passId,
+        CODE_MODE_PASS: encodeHarnessPassConfig({
           namespaces: request.namespaces.map((namespace) => ({
             name: namespace.name,
             methods: namespace.methods,
@@ -644,9 +648,10 @@ const makeExecute = (options: DynamicWorkerCodeExecutorOptions): CodeExecutorExe
 
     const worker = yield* Effect.acquireRelease(
       Effect.try({
-        try: () => options.loader.load(workerCode as never),
+        try: () => options.loader.load(workerCode),
         catch: (cause) => {
-          const text = cause instanceof Error ? cause.message : String(cause);
+          const text = safeCauseMessage(cause, "The Worker Loader failed without a diagnostic");
+
           // Blame the program's source ONLY on a genuine compile diagnostic;
           // any other load rejection is an infrastructure start failure, not
           // the model's fault (see classifyWorkerFailure for the same split).
@@ -657,6 +662,7 @@ const makeExecute = (options: DynamicWorkerCodeExecutorOptions): CodeExecutorExe
               message: text.slice(0, 8_000),
             });
           }
+
           return CodeExecutorStartError.make({
             implementation: dynamicWorkerImplementation,
             message: `The Worker Loader rejected the pass: ${text}`.slice(0, 8_000),
@@ -664,23 +670,23 @@ const makeExecute = (options: DynamicWorkerCodeExecutorOptions): CodeExecutorExe
           });
         },
       }),
-      (stub) =>
-        Effect.sync(() => {
-          (stub as Partial<Record<typeof Symbol.dispose, () => void>>)[Symbol.dispose]?.();
-        }),
+      disposeRpcHandle,
+    );
+
+    const entrypoint = yield* Effect.acquireRelease(
+      Effect.try({
+        try: () => worker.getEntrypoint<CodeModeHarnessEntrypoint>(),
+        catch: (cause) => classifyWorkerFailure(cause, request.limits.maxWallTime),
+      }),
+      disposeRpcHandle,
     );
 
     const rpc = Effect.tryPromise({
-      try: async () => {
-        const entrypoint = worker.getEntrypoint() as unknown as {
-          run(): Promise<unknown>;
-        };
-        return await entrypoint.run();
-      },
+      try: () => entrypoint.run(new CodeModePassHostTarget(dispatch)),
       catch: (cause) => classifyWorkerFailure(cause, request.limits.maxWallTime),
     });
 
-    const raw = yield* Effect.raceFirst(
+    const exit = yield* Effect.raceFirst(
       rpc.pipe(
         Effect.timeoutOrElse({
           duration: remainingPassWallTime(),
@@ -693,18 +699,22 @@ const makeExecute = (options: DynamicWorkerCodeExecutorOptions): CodeExecutorExe
             }),
         }),
       ),
-      Effect.promise(() => hostDispatchFailureSignal).pipe(
-        Effect.flatMap(propagateHostDispatchFailure),
-      ),
-    );
-    yield* stopHostDispatch;
-    const finishedAt = performance.now();
+      Fiber.join(server),
+    ).pipe(Effect.exit);
 
-    if (hostDispatchFailure !== undefined) {
-      return yield* propagateHostDispatchFailure(hostDispatchFailure);
+    yield* closeAdmission;
+    yield* Fiber.interrupt(server);
+    if (passFailure !== undefined) {
+      return yield* passFailure;
+    }
+    if (Exit.isFailure(exit)) {
+      return yield* Effect.failCause(exit.cause);
     }
+    const raw = exit.value;
+    const finishedAt = clock.monotonicTimeNanosUnsafe();
 
     const outcome = decodeHarnessOutcome(raw);
+
     if (Option.isNone(outcome)) {
       return yield* CodeExecutionProtocolError.make({
         implementation: dynamicWorkerImplementation,
@@ -718,20 +728,13 @@ const makeExecute = (options: DynamicWorkerCodeExecutorOptions): CodeExecutorExe
           value: outcome.value.value,
           logs: outcome.value.logs,
           resourceUse: CodeExecutionResourceUse.make({
-            wallTime: Duration.millis(Math.max(0, finishedAt - startedAt)),
+            wallTime: Duration.nanos(finishedAt > startedAt ? finishedAt - startedAt : 0n),
             hostCalls: outcome.value.hostCalls,
             logBytes: outcome.value.logBytes,
             resultBytes: outcome.value.resultBytes,
           }),
         });
       }
-      case "source-invalid": {
-        return yield* CodeSourceError.make({
-          implementation: dynamicWorkerImplementation,
-          reason: "invalid",
-          message: outcome.value.message.slice(0, 8_000),
-        });
-      }
       case "source-not-a-function": {
         return yield* CodeSourceError.make({
           implementation: dynamicWorkerImplementation,
@@ -804,13 +807,8 @@ const classifyWorkerFailure = (
   | CodeExecutorTerminatedError
   | CodeExecutorStartError
   | CodeSourceError => {
-  const text = (() => {
-    try {
-      return cause instanceof Error ? `${cause.name}: ${cause.message}` : String(cause);
-    } catch {
-      return "[unserializable worker failure]";
-    }
-  })();
+  const text = safeCauseDiagnostic(cause, "[unserializable worker failure]");
+
   // `WorkerLoader.load()` is lazy, so a module-compile error in the generated
   // program surfaces here at first use. Blame the program's source ONLY on a
   // genuine compile diagnostic (a `SyntaxError` or an explicit compile
@@ -840,6 +838,7 @@ const classifyWorkerFailure = (
       cause,
     });
   }
+
   return CodeExecutorTerminatedError.make({
     implementation: dynamicWorkerImplementation,
     message: text.slice(0, 8_000),
@@ -850,4 +849,30 @@ const classifyWorkerFailure = (
 export const dynamicWorkerCodeExecutorLayer = (
   options: DynamicWorkerCodeExecutorOptions,
 ): Layer.Layer<CodeExecutor> =>
-  Layer.succeed(CodeExecutor)(CodeExecutor.of({ execute: makeExecute(options) }));
+  Layer.effect(
+    CodeExecutor,
+    Effect.gen(function* () {
+      const clock = yield* Clock.Clock;
+
+      return CodeExecutor.of({ execute: makeExecute(options, clock) });
+    }),
+  );
+
+/** Assemble Code Mode handlers with the isolated Dynamic Worker executor. */
+export const CloudflareCodeMode = {
+  /**
+   * Provide the selected tool handlers at construction, where Code Mode captures them.
+   * Their errors and remaining dependencies stay visible. The definition still owns the
+   * allowlist and limits; the runtime supplies the live Tool broker for each scoped pass.
+   */
+  layer: <A, E, R, Handlers, HandlerError, HandlerRequirements>(
+    definition: { readonly handlers: Layer.Layer<A, E, R> },
+    options: DynamicWorkerCodeExecutorOptions & {
+      readonly handlers: Layer.Layer<Handlers, HandlerError, HandlerRequirements>;
+    },
+  ) =>
+    definition.handlers.pipe(
+      Layer.provide(options.handlers),
+      Layer.provide(dynamicWorkerCodeExecutorLayer(options)),
+    ),
+};