@effect-agent/platform-cloudflare 0.1.0-beta.8 → 0.1.0-beta.80

package/src/{code-mode-executor.ts → CloudflareCodeMode.ts}

@@ -1,6 +1,5 @@
 import {
   CodeExecutionHost,
-  CodeExecutionRequest,
   CodeExecutionResourceUse,
   CodeExecutionResult,
   CodeExecutionTimeoutError,
@@ -15,59 +14,56 @@ import {
   CodeOutputLimitError,
   CodeProgramFailedError,
   CodeSourceError,
-  SandboxImplementation,
   type CodeExecutorExecute,
-} from "@effect-agent/sandbox";
-import { WorkerEntrypoint } from "cloudflare:workers";
-import { Clock, Duration, Effect, Fiber, Layer, Option, Schema } from "effect";
+  type CodeExecutionRequest,
+} from "@effect-agent/sandbox/CodeExecutor";
+import { SandboxImplementation } from "@effect-agent/sandbox/Sandbox";
+import { RpcTarget } from "cloudflare:workers";
+import { Clock, Duration, Effect, Exit, Fiber, Layer, Option, Queue, Schema } from "effect";
+
+import { safeCauseDiagnostic, safeCauseMessage } from "./internal/boundary.ts";
 
 /**
  * The Cloudflare Dynamic Worker `CodeExecutor` adapter (C4 of ADR-0017;
  * DEPLOY-011). Each pass loads one fresh Worker through the Worker Loader
  * with `globalOutbound: null`, so generated code has no ambient network,
- * bindings, or secrets; its only authority is the pass-scoped host stub that
- * routes back to `CodeModeHostEntrypoint` and, from there, into the pass's
- * `CodeExecutionHost` service. Platform CPU limits stop synchronous runaway
- * programs; the executor-owned wall-clock deadline interrupts asynchronously
- * suspended passes. Deployment class `E` only: the adapter records no
- * persistent state and a later pass may run in a completely different
- * isolate.
+ * bindings, or secrets; its only authority is the pass-scoped RPC target that
+ * routes back into the owning event's `CodeExecutionHost` service. Platform
+ * CPU limits stop synchronous runaway programs; the executor-owned wall-clock
+ * deadline interrupts asynchronously suspended passes. Deployment class `E`
+ * only: the adapter records no persistent state and a later pass may run in a
+ * completely different isolate.
  */
 export const dynamicWorkerImplementation = SandboxImplementation.make({
   isolation: "isolated",
   identity: "cloudflare-dynamic-worker",
 });
 
-/** The narrow host stub the dynamic worker receives (Workers RPC). */
-export interface CodeModeHostStub {
-  readonly call: (passId: string, hostCall: unknown) => Promise<unknown>;
+interface CodeModePassHost extends Rpc.RpcTargetBranded {
+  readonly call: (hostCall: unknown) => Promise<unknown>;
 }
 
-interface RegisteredPass {
-  readonly dispatch: (hostCall: unknown) => Promise<unknown>;
+interface CodeModeHarnessEntrypoint extends Rpc.WorkerEntrypointBranded {
+  readonly run: (host: CodeModePassHost) => Promise<unknown>;
 }
 
 /**
- * Live passes by identity. Entries are Scope-managed: registered when a pass
- * opens and removed by its finalizer, so a stale harness (or a forged
- * `passId`) cannot reach any host authority.
+ * One object-capability endpoint for one execution pass. Workers RPC invokes
+ * the target in the request context where it was created, so the native
+ * Promise returned by `dispatch` and the Effect fiber that settles it share
+ * one I/O owner. Passing the target as `run()`'s argument also scopes the
+ * remote stub to that RPC call; no request state lives at module scope.
  */
-const passRegistry = new Map<string, RegisteredPass>();
+class CodeModePassHostTarget extends RpcTarget implements CodeModePassHost {
+  readonly #dispatch: (hostCall: unknown) => Promise<unknown>;
 
-/**
- * The host-side RPC target for dynamic workers. The application exposes it
- * from its Worker entry (`export { CodeModeHostEntrypoint }`) and hands the
- * adapter a same-instance stub — `ctx.exports.CodeModeHostEntrypoint()` in
- * production (a self service binding may reach a different instance and must
- * not be used there); tests bind it through Miniflare's `kCurrentWorker`.
- */
-export class CodeModeHostEntrypoint extends WorkerEntrypoint {
-  async call(passId: unknown, hostCall: unknown): Promise<unknown> {
-    const pass = passRegistry.get(String(passId));
-    if (pass === undefined) {
-      throw new Error("Unknown Code Mode pass");
-    }
-    return pass.dispatch(hostCall);
+  constructor(dispatch: (hostCall: unknown) => Promise<unknown>) {
+    super();
+    this.#dispatch = dispatch;
+  }
+
+  call(hostCall: unknown): Promise<unknown> {
+    return this.#dispatch(hostCall);
   }
 }
 
@@ -103,9 +99,8 @@ const safeJson = (value) => {
 };
 
 export default class CodeModeHarness extends WorkerEntrypoint {
-  async run() {
-    const config = JSON.parse(this.env.CODE_MODE_PASS);
-    const host = this.env.CODE_MODE_HOST;
+  async run(host) {
+    const config = this.env.CODE_MODE_PASS;
     const limits = config.limits;
     const logs = [];
     let logBytes = 0;
@@ -143,7 +138,7 @@ export default class CodeModeHarness extends WorkerEntrypoint {
         };
         throw new Error("code-mode host-call argument limit exceeded");
       }
-      const outcome = await host.call(config.passId, {
+      const outcome = await host.call({
         namespace,
         method,
         argument: JSON.parse(argText),
@@ -227,55 +222,50 @@ const BoundedLogs = Schema.Array(Schema.String.check(Schema.isMaxLength(16 * 102
   Schema.isMaxLength(4_096),
 );
 
-const HarnessCompleted = Schema.Struct({
-  _tag: Schema.Literal("completed"),
+const HarnessCompleted = Schema.TaggedStruct("completed", {
   value: Schema.Json,
   logs: BoundedLogs,
   hostCalls: Schema.Natural,
   logBytes: Schema.Natural,
   resultBytes: Schema.Natural,
 });
-const HarnessSourceInvalid = Schema.Struct({
-  _tag: Schema.Literal("source-invalid"),
-  message: Schema.String,
-});
-const HarnessNotAFunction = Schema.Struct({
-  _tag: Schema.Literal("source-not-a-function"),
+
+const HarnessNotAFunction = Schema.TaggedStruct("source-not-a-function", {
   actual: Schema.String,
 });
-const HarnessProgramFailed = Schema.Struct({
-  _tag: Schema.Literal("program-failed"),
+
+const HarnessProgramFailed = Schema.TaggedStruct("program-failed", {
   reason: Schema.Literals(["threw", "rejected", "non-json-result"]),
   thrown: Schema.Json,
   message: Schema.String,
   logs: BoundedLogs,
 });
-const HarnessLogLimit = Schema.Struct({
-  _tag: Schema.Literal("log-limit"),
+
+const HarnessLogLimit = Schema.TaggedStruct("log-limit", {
   observed: Schema.Natural,
   logs: BoundedLogs,
 });
-const HarnessArgumentLimit = Schema.Struct({
-  _tag: Schema.Literal("argument-limit"),
+
+const HarnessArgumentLimit = Schema.TaggedStruct("argument-limit", {
   observed: Schema.Natural,
   logs: BoundedLogs,
 });
-const HarnessResultLimit = Schema.Struct({
-  _tag: Schema.Literal("result-limit"),
+
+const HarnessResultLimit = Schema.TaggedStruct("result-limit", {
   observed: Schema.Natural,
   logs: BoundedLogs,
 });
-const HarnessHostCallLimit = Schema.Struct({
-  _tag: Schema.Literal("host-call-limit"),
+
+const HarnessHostCallLimit = Schema.TaggedStruct("host-call-limit", {
   logs: BoundedLogs,
 });
-const HarnessProtocol = Schema.Struct({
-  _tag: Schema.Literal("protocol"),
+
+const HarnessProtocol = Schema.TaggedStruct("protocol", {
   message: Schema.String,
 });
+
 const HarnessOutcome = Schema.Union([
   HarnessCompleted,
-  HarnessSourceInvalid,
   HarnessNotAFunction,
   HarnessProgramFailed,
   HarnessLogLimit,
@@ -285,6 +275,25 @@ const HarnessOutcome = Schema.Union([
   HarnessProtocol,
 ]);
 
+const HarnessPassConfig = Schema.Struct({
+  namespaces: Schema.Array(
+    Schema.Struct({
+      name: Schema.NonEmptyString,
+      methods: Schema.Array(Schema.NonEmptyString).check(Schema.isMaxLength(64)),
+    }),
+  ).check(Schema.isMaxLength(32)),
+  limits: Schema.Struct({
+    maxLogBytes: Schema.Natural,
+    maxResultBytes: Schema.Natural,
+    maxHostCalls: Schema.Natural,
+    maxHostCallArgumentBytes: Schema.Natural,
+  }),
+});
+
+const encodeHarnessPassConfig = Schema.encodeSync(HarnessPassConfig);
+const encodeJsonPayload = Schema.encodeSync(Schema.fromJsonString(Schema.Json));
+const decodeJsonPayload = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Json));
+
 const decodeHarnessOutcome = (value: unknown) => {
   try {
     return Schema.decodeUnknownOption(HarnessOutcome)(value);
@@ -301,6 +310,36 @@ const decodeHostCall = (value: unknown) => {
   }
 };
 
+const decodeHostCallResult = (value: unknown) => {
+  try {
+    return Schema.decodeUnknownOption(CodeHostCallResult)(value);
+  } catch {
+    return Option.none<CodeHostCallResult>();
+  }
+};
+
+/** Dispose a Cloudflare RPC handle when the runtime supplies its untyped disposal hook. @internal */
+export const disposeRpcHandle = (handle: unknown): Effect.Effect<void> =>
+  Effect.try({
+    try: () => {
+      if ((typeof handle !== "object" && typeof handle !== "function") || handle === null) return;
+      if (!(Symbol.dispose in handle)) return;
+      const dispose = Reflect.get(handle, Symbol.dispose);
+
+      if (typeof dispose === "function") {
+        Reflect.apply(dispose, handle, []);
+      }
+    },
+    catch: (cause) =>
+      safeCauseDiagnostic(cause, "The Cloudflare RPC disposal hook failed without a diagnostic"),
+  }).pipe(
+    Effect.catch((diagnostic) =>
+      Effect.logWarning(`Cloudflare RPC handle disposal failed: ${diagnostic}`).pipe(
+        Effect.ignoreCause,
+      ),
+    ),
+  );
+
 /**
  * Project a host outcome to the plain JSON envelope the harness reads. A
  * `CodeExecutionHost` may return either real `CodeHostCallResult` instances
@@ -308,54 +347,69 @@ const decodeHostCall = (value: unknown) => {
  * Mode capability's broker route), so this reads the shared fields rather than
  * `Schema.encodeSync`, which would reject a plain object.
  */
-const hostResultEnvelope = (outcome: CodeHostCallResult): Record<string, unknown> =>
-  outcome._tag === "CodeHostCallSuccess"
-    ? { _tag: "CodeHostCallSuccess", value: outcome.value }
-    : { _tag: "CodeHostCallFailure", error: outcome.error };
+interface EncodedHostResultPayload {
+  readonly encodedPayload: string;
+  readonly resultBytes: number;
+}
+
+const encodeHostResultPayload = (
+  outcome: CodeHostCallResult,
+): EncodedHostResultPayload | undefined => {
+  try {
+    const payload = outcome._tag === "CodeHostCallSuccess" ? outcome.value : outcome.error;
+    const encodedPayload = encodeJsonPayload(payload);
+
+    return {
+      encodedPayload,
+      resultBytes: utf8ByteLength(encodedPayload),
+    };
+  } catch {
+    return undefined;
+  }
+};
 
 const utf8ByteLength = (value: string): number => {
   let total = 0;
+
   for (const character of value) {
     const codePoint = character.codePointAt(0) ?? 0;
+
     total += codePoint <= 0x7f ? 1 : codePoint <= 0x7ff ? 2 : codePoint <= 0xffff ? 3 : 4;
   }
-  return total;
-};
 
-const encodedJsonByteLength = (value: unknown): number | undefined => {
-  try {
-    const encoded = JSON.stringify(value);
-    return encoded === undefined ? undefined : utf8ByteLength(encoded);
-  } catch {
-    return undefined;
-  }
+  return total;
 };
 
-interface PendingHostCall {
-  readonly hostCall: unknown;
+interface QueuedHostCall {
+  readonly call: CodeHostCall;
   readonly resolve: (value: unknown) => void;
   readonly reject: (reason: unknown) => void;
 }
 
+type HostWork =
+  | { readonly _tag: "call"; readonly queued: QueuedHostCall }
+  | { readonly _tag: "limit" };
+
+type HostDispatchError =
+  | CodeExecutionTimeoutError
+  | CodeOutputLimitError
+  | CodeExecutionProtocolError
+  | CodeHostCallLimitError;
+
 /** Reserved global names the harness owns inside the dynamic worker. */
 const reservedHarnessGlobals = new Set(["console"]);
 
 export interface DynamicWorkerCodeExecutorOptions {
   /** The `worker_loader` binding. */
   readonly loader: WorkerLoader;
-  /**
-   * A SAME-INSTANCE stub of `CodeModeHostEntrypoint`. In production create it
-   * with `ctx.exports.CodeModeHostEntrypoint()`; a cross-instance stub would
-   * dispatch host calls into an isolate without this pass's registry entry.
-   */
-  readonly hostStub: CodeModeHostStub;
   /** Compatibility date for dynamic workers; defaults to `2025-05-01`. */
   readonly compatibilityDate?: string | undefined;
 }
 
-const passCounterState = { next: 0 };
-
-const makeExecute = (options: DynamicWorkerCodeExecutorOptions): CodeExecutorExecute =>
+const makeExecute = (
+  options: DynamicWorkerCodeExecutorOptions,
+  clock: Clock.Clock,
+): CodeExecutorExecute =>
   Effect.fn("DynamicWorkerCodeExecutor.execute")(function* (request: CodeExecutionRequest) {
     if (request.network._tag !== "NetworkDisabled") {
       return yield* CodeExecutorUnsupportedError.make({
@@ -366,6 +420,7 @@ const makeExecute = (options: DynamicWorkerCodeExecutorOptions): CodeExecutorExe
       });
     }
     const sourceBytes = utf8ByteLength(request.source);
+
     if (sourceBytes > request.limits.maxSourceBytes) {
       return yield* CodeSourceError.make({
         implementation: dynamicWorkerImplementation,
@@ -382,106 +437,192 @@ const makeExecute = (options: DynamicWorkerCodeExecutorOptions): CodeExecutorExe
         });
       }
     }
-
     const host = yield* CodeExecutionHost;
-    passCounterState.next += 1;
-    // The pass id is the only credential a loaded program presents to reach
-    // its host authority, so it must be unguessable: a program cannot forge
-    // another pass's id even if two passes were ever concurrent (the broker
-    // keeps them sequential, but the id must not rely on that). The counter
-    // prefix keeps ids debuggable; the random suffix makes them unforgeable.
-    const passId = `code-mode-pass-${passCounterState.next}-${crypto.randomUUID()}`;
-
-    // Promise-side host calls bridge into the Effect world through a pending
-    // list served by a scoped fiber, exactly like the deterministic
-    // substitute: interruption reaches in-flight host calls, and pass-fatal
-    // conditions fail the pass by failing the server.
-    const pending: Array<PendingHostCall> = [];
-    let wake: (() => void) | undefined;
+
+    // This synchronous clock access is confined to callbacks that must compute a timeout
+    // immediately. The Clock service remains the authority, so tests and hosts can replace it.
+    const startedAt = clock.monotonicTimeNanosUnsafe();
+    const passDeadline = startedAt + Duration.toNanosUnsafe(request.limits.maxWallTime);
+
+    const remainingPassWallTime = (): Duration.Duration => {
+      const now = clock.monotonicTimeNanosUnsafe();
+
+      return Duration.nanos(passDeadline > now ? passDeadline - now : 0n);
+    };
+
     let issuedHostCalls = 0;
-    const dispatch = (hostCall: unknown): Promise<unknown> =>
-      new Promise((resolve, reject) => {
-        issuedHostCalls += 1;
-        if (issuedHostCalls > request.limits.maxHostCalls + 1) {
-          reject(new Error("host-call limit exceeded"));
-          return;
-        }
-        pending.push({ hostCall, resolve, reject });
-        wake?.();
-      });
+    let passOpen = true;
+    const queuedHostCalls: Array<QueuedHostCall> = [];
+    let passFailure: HostDispatchError | undefined;
 
-    yield* Effect.acquireRelease(
-      Effect.sync(() => {
-        passRegistry.set(passId, { dispatch });
-      }),
-      () =>
-        Effect.sync(() => {
-          passRegistry.delete(passId);
-        }),
-    );
+    const failPass = (error: HostDispatchError): void => {
+      if (passFailure === undefined) passFailure = error;
+    };
 
-    const nextPending = Effect.suspend(() => {
-      const item = pending.shift();
-      if (item !== undefined) {
-        return Effect.succeed(item);
+    const rejectQueuedHostCalls = (reason: Error): void => {
+      for (const queued of queuedHostCalls.splice(0)) {
+        queued.reject(reason);
       }
-      return Effect.callback<PendingHostCall>((resume) => {
-        wake = () => {
-          wake = undefined;
-          const next = pending.shift();
-          if (next !== undefined) {
-            resume(Effect.succeed(next));
-          }
-        };
+    };
+
+    const queue = yield* Queue.unbounded<HostWork>();
+
+    const deliverHostOutcome = (
+      queued: QueuedHostCall,
+      outcome: CodeHostCallResult,
+    ): Effect.Effect<void, CodeExecutionProtocolError | CodeOutputLimitError> =>
+      Effect.gen(function* () {
+        const decoded = decodeHostCallResult(outcome);
+
+        if (Option.isNone(decoded)) {
+          const error = CodeExecutionProtocolError.make({
+            implementation: dynamicWorkerImplementation,
+            message: "The execution host returned a value outside the CodeHostCallResult schema",
+          });
+
+          failPass(error);
+
+          return yield* error;
+        }
+        const encoded = encodeHostResultPayload(decoded.value);
+
+        if (encoded === undefined || encoded.resultBytes > request.limits.maxHostCallResultBytes) {
+          const error = CodeOutputLimitError.make({
+            implementation: dynamicWorkerImplementation,
+            surface: "host-call-result",
+            limit: request.limits.maxHostCallResultBytes,
+            observed: encoded?.resultBytes ?? 0,
+            logs: [],
+          });
+
+          failPass(error);
+
+          return yield* error;
+        }
+        const normalizedPayload = decodeJsonPayload(encoded.encodedPayload);
+
+        if (Option.isNone(normalizedPayload)) {
+          const error = CodeExecutionProtocolError.make({
+            implementation: dynamicWorkerImplementation,
+            message: "The execution host returned a result that could not cross the JSON boundary",
+          });
+
+          failPass(error);
+
+          return yield* error;
+        }
+        queued.resolve(
+          decoded.value._tag === "CodeHostCallSuccess"
+            ? { _tag: "CodeHostCallSuccess", value: normalizedPayload.value }
+            : { _tag: "CodeHostCallFailure", error: normalizedPayload.value },
+        );
       });
-    });
 
+    // Workers RPC into the loader isolate cannot settle on the fiber blocked
+    // in `entrypoint.run()`. A Scope-owned sibling fiber keeps that
+    // independence while inheriting the pass Context and dying with the Scope.
     const serveHostCalls = Effect.gen(function* () {
-      let served = 0;
       while (true) {
-        const item = yield* nextPending;
-        served += 1;
-        if (served > request.limits.maxHostCalls) {
-          return yield* CodeHostCallLimitError.make({
+        const work = yield* Queue.take(queue);
+
+        if (work._tag === "limit") {
+          const error = CodeHostCallLimitError.make({
             implementation: dynamicWorkerImplementation,
             limit: request.limits.maxHostCalls,
             logs: [],
           });
+
+          failPass(error);
+
+          return yield* error;
         }
-        const decoded = decodeHostCall(item.hostCall);
-        if (Option.isNone(decoded)) {
-          item.reject(new TypeError("host calls must match the CodeHostCall schema"));
-          continue;
-        }
-        const outcome = yield* host.call(decoded.value);
-        if (outcome._tag === "CodeHostCallSuccess") {
-          const bytes = encodedJsonByteLength(outcome.value);
-          if (bytes === undefined || bytes > request.limits.maxHostCallResultBytes) {
-            return yield* CodeOutputLimitError.make({
-              implementation: dynamicWorkerImplementation,
-              surface: "host-call-result",
-              limit: request.limits.maxHostCallResultBytes,
-              observed: bytes ?? 0,
-              logs: [],
-            });
-          }
-        }
-        item.resolve(hostResultEnvelope(outcome));
+        const queued = work.queued;
+
+        yield* host.call(queued.call).pipe(
+          Effect.timeoutOrElse({
+            duration: remainingPassWallTime(),
+            orElse: () => {
+              const error = CodeExecutionTimeoutError.make({
+                implementation: dynamicWorkerImplementation,
+                kind: "wall-clock",
+                maxWallTime: request.limits.maxWallTime,
+                logs: [],
+              });
+
+              failPass(error);
+
+              return error;
+            },
+          }),
+          Effect.flatMap((outcome) => deliverHostOutcome(queued, outcome)),
+          Effect.tapError(() =>
+            Effect.sync(() => queued.reject(new Error("Code Mode host call failed"))),
+          ),
+          Effect.onInterrupt(() =>
+            Effect.sync(() => queued.reject(new Error("Code Mode pass is closing"))),
+          ),
+        );
+      }
+    });
+
+    const concurrency = request.limits.maxHostCallConcurrency ?? 4;
+
+    const server = yield* Effect.all(
+      Array.from({ length: concurrency }, () => serveHostCalls),
+      { concurrency, discard: true },
+    ).pipe(Effect.andThen(Effect.never), Effect.forkScoped);
+
+    const dispatch = (hostCall: unknown): Promise<unknown> => {
+      if (!passOpen) {
+        return Promise.reject(new Error("Code Mode pass is closing"));
+      }
+      issuedHostCalls += 1;
+      if (issuedHostCalls > request.limits.maxHostCalls) {
+        const error = CodeHostCallLimitError.make({
+          implementation: dynamicWorkerImplementation,
+          limit: request.limits.maxHostCalls,
+          logs: [],
+        });
+
+        failPass(error);
+        Queue.offerUnsafe(queue, { _tag: "limit" });
+
+        return Promise.reject(new Error("host-call limit exceeded"));
+      }
+      const decoded = decodeHostCall(hostCall);
+
+      if (Option.isNone(decoded)) {
+        return Promise.reject(new TypeError("host calls must match the CodeHostCall schema"));
       }
+
+      return new Promise((resolve, reject) => {
+        const queued = { call: decoded.value, resolve, reject };
+
+        queuedHostCalls.push(queued);
+        Queue.offerUnsafe(queue, { _tag: "call", queued });
+      });
+    };
+
+    const closeAdmission = Effect.sync(() => {
+      passOpen = false;
+      rejectQueuedHostCalls(new Error("Code Mode pass is closing"));
     });
 
-    const workerCode = {
+    yield* Effect.addFinalizer(() => closeAdmission.pipe(Effect.andThen(Fiber.interrupt(server))));
+
+    // No `allowExperimental`: the runtime only accepts it when the CALLING
+    // worker carries the `experimental` compatibility flag, which deployed
+    // consumers cannot set — the option would reject every pass in
+    // production. The harness needs no experimental runtime features.
+    const workerCode: WorkerLoaderWorkerCode = {
       compatibilityDate: options.compatibilityDate ?? "2025-05-01",
-      allowExperimental: true,
       mainModule: "harness.js",
       modules: {
         "harness.js": HARNESS_MODULE,
         "program.js": `export default (\n${request.source}\n);`,
       },
       env: {
-        CODE_MODE_HOST: options.hostStub,
-        CODE_MODE_PASS: JSON.stringify({
-          passId,
+        CODE_MODE_PASS: encodeHarnessPassConfig({
           namespaces: request.namespaces.map((namespace) => ({
             name: namespace.name,
             methods: namespace.methods,
@@ -505,12 +646,12 @@ const makeExecute = (options: DynamicWorkerCodeExecutorOptions): CodeExecutorExe
           }),
     };
 
-    const startedAt = yield* Clock.currentTimeMillis;
     const worker = yield* Effect.acquireRelease(
       Effect.try({
-        try: () => options.loader.load(workerCode as never),
+        try: () => options.loader.load(workerCode),
         catch: (cause) => {
-          const text = cause instanceof Error ? cause.message : String(cause);
+          const text = safeCauseMessage(cause, "The Worker Loader failed without a diagnostic");
+
           // Blame the program's source ONLY on a genuine compile diagnostic;
           // any other load rejection is an infrastructure start failure, not
           // the model's fault (see classifyWorkerFailure for the same split).
@@ -521,6 +662,7 @@ const makeExecute = (options: DynamicWorkerCodeExecutorOptions): CodeExecutorExe
               message: text.slice(0, 8_000),
             });
           }
+
           return CodeExecutorStartError.make({
             implementation: dynamicWorkerImplementation,
             message: `The Worker Loader rejected the pass: ${text}`.slice(0, 8_000),
@@ -528,40 +670,51 @@ const makeExecute = (options: DynamicWorkerCodeExecutorOptions): CodeExecutorExe
           });
         },
       }),
-      (stub) =>
-        Effect.sync(() => {
-          (stub as Partial<Record<typeof Symbol.dispose, () => void>>)[Symbol.dispose]?.();
-        }),
+      disposeRpcHandle,
     );
 
-    const server = yield* serveHostCalls.pipe(Effect.forkScoped);
+    const entrypoint = yield* Effect.acquireRelease(
+      Effect.try({
+        try: () => worker.getEntrypoint<CodeModeHarnessEntrypoint>(),
+        catch: (cause) => classifyWorkerFailure(cause, request.limits.maxWallTime),
+      }),
+      disposeRpcHandle,
+    );
 
     const rpc = Effect.tryPromise({
-      try: async () => {
-        const entrypoint = worker.getEntrypoint() as unknown as {
-          run(): Promise<unknown>;
-        };
-        return await entrypoint.run();
-      },
+      try: () => entrypoint.run(new CodeModePassHostTarget(dispatch)),
       catch: (cause) => classifyWorkerFailure(cause, request.limits.maxWallTime),
     });
 
-    const raw = yield* Effect.raceFirst(rpc, Fiber.join(server)).pipe(
-      Effect.timeoutOrElse({
-        duration: request.limits.maxWallTime,
-        orElse: () =>
-          CodeExecutionTimeoutError.make({
-            implementation: dynamicWorkerImplementation,
-            kind: "wall-clock",
-            maxWallTime: request.limits.maxWallTime,
-            logs: [],
-          }),
-      }),
-      Effect.ensuring(Fiber.interrupt(server)),
-    );
-    const finishedAt = yield* Clock.currentTimeMillis;
+    const exit = yield* Effect.raceFirst(
+      rpc.pipe(
+        Effect.timeoutOrElse({
+          duration: remainingPassWallTime(),
+          orElse: () =>
+            CodeExecutionTimeoutError.make({
+              implementation: dynamicWorkerImplementation,
+              kind: "wall-clock",
+              maxWallTime: request.limits.maxWallTime,
+              logs: [],
+            }),
+        }),
+      ),
+      Fiber.join(server),
+    ).pipe(Effect.exit);
+
+    yield* closeAdmission;
+    yield* Fiber.interrupt(server);
+    if (passFailure !== undefined) {
+      return yield* passFailure;
+    }
+    if (Exit.isFailure(exit)) {
+      return yield* Effect.failCause(exit.cause);
+    }
+    const raw = exit.value;
+    const finishedAt = clock.monotonicTimeNanosUnsafe();
 
     const outcome = decodeHarnessOutcome(raw);
+
     if (Option.isNone(outcome)) {
       return yield* CodeExecutionProtocolError.make({
         implementation: dynamicWorkerImplementation,
@@ -575,20 +728,13 @@ const makeExecute = (options: DynamicWorkerCodeExecutorOptions): CodeExecutorExe
           value: outcome.value.value,
           logs: outcome.value.logs,
           resourceUse: CodeExecutionResourceUse.make({
-            wallTime: Duration.millis(Math.max(0, finishedAt - startedAt)),
+            wallTime: Duration.nanos(finishedAt > startedAt ? finishedAt - startedAt : 0n),
             hostCalls: outcome.value.hostCalls,
             logBytes: outcome.value.logBytes,
             resultBytes: outcome.value.resultBytes,
           }),
         });
       }
-      case "source-invalid": {
-        return yield* CodeSourceError.make({
-          implementation: dynamicWorkerImplementation,
-          reason: "invalid",
-          message: outcome.value.message.slice(0, 8_000),
-        });
-      }
       case "source-not-a-function": {
         return yield* CodeSourceError.make({
           implementation: dynamicWorkerImplementation,
@@ -661,13 +807,8 @@ const classifyWorkerFailure = (
   | CodeExecutorTerminatedError
   | CodeExecutorStartError
   | CodeSourceError => {
-  const text = (() => {
-    try {
-      return cause instanceof Error ? `${cause.name}: ${cause.message}` : String(cause);
-    } catch {
-      return "[unserializable worker failure]";
-    }
-  })();
+  const text = safeCauseDiagnostic(cause, "[unserializable worker failure]");
+
   // `WorkerLoader.load()` is lazy, so a module-compile error in the generated
   // program surfaces here at first use. Blame the program's source ONLY on a
   // genuine compile diagnostic (a `SyntaxError` or an explicit compile
@@ -697,6 +838,7 @@ const classifyWorkerFailure = (
       cause,
     });
   }
+
   return CodeExecutorTerminatedError.make({
     implementation: dynamicWorkerImplementation,
     message: text.slice(0, 8_000),
@@ -707,4 +849,30 @@ const classifyWorkerFailure = (
 export const dynamicWorkerCodeExecutorLayer = (
   options: DynamicWorkerCodeExecutorOptions,
 ): Layer.Layer<CodeExecutor> =>
-  Layer.succeed(CodeExecutor)(CodeExecutor.of({ execute: makeExecute(options) }));
+  Layer.effect(
+    CodeExecutor,
+    Effect.gen(function* () {
+      const clock = yield* Clock.Clock;
+
+      return CodeExecutor.of({ execute: makeExecute(options, clock) });
+    }),
+  );
+
+/** Assemble Code Mode handlers with the isolated Dynamic Worker executor. */
+export const CloudflareCodeMode = {
+  /**
+   * Provide the selected tool handlers at construction, where Code Mode captures them.
+   * Their errors and remaining dependencies stay visible. The definition still owns the
+   * allowlist and limits; the runtime supplies the live Tool broker for each scoped pass.
+   */
+  layer: <A, E, R, Handlers, HandlerError, HandlerRequirements>(
+    definition: { readonly handlers: Layer.Layer<A, E, R> },
+    options: DynamicWorkerCodeExecutorOptions & {
+      readonly handlers: Layer.Layer<Handlers, HandlerError, HandlerRequirements>;
+    },
+  ) =>
+    definition.handlers.pipe(
+      Layer.provide(options.handlers),
+      Layer.provide(dynamicWorkerCodeExecutorLayer(options)),
+    ),
+};