@hoilab/ada-cli 0.84.21 → 0.85.0

package/dist/core/workflows/resolve-script.js

@@ -0,0 +1,66 @@
+/**
+ * Resolución de scripts de workflow POR NOMBRE (§16.1).
+ *
+ * Orden de resolución:
+ *   1. Builtin versionado con el SDK (deep_research, code_review, …).
+ *   2. Script guardado por el usuario: <agentDir>/workflows/<name>.js
+ *      (cualquier JS con la API del runtime: agent/parallel/pipeline/phase/
+ *      store/checkpoint/args/cwd/runId/log — scripts DINÁMICOS completos).
+ *
+ * Un solo punto de verdad para CLI (/workflow), RPC (desktop), la tool
+ * `workflow` del agente y el SDK.
+ */
+import { readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { generateCodebaseAuditScript, generateCodeReviewScript, generateDeepResearchScript, generateMultiPerspectiveScript, generateProductBuildScript, } from "./builtins.js";
+/** Resuelve un builtin por nombre; null si no lo es. */
+export function resolveBuiltinWorkflowScript(name) {
+    switch (name.replace(/-/g, "_").toLowerCase()) {
+        case "deep_research":
+            return generateDeepResearchScript({});
+        case "code_review":
+            return generateCodeReviewScript({});
+        case "product_build":
+            return generateProductBuildScript();
+        case "codebase_audit":
+            return generateCodebaseAuditScript({});
+        case "multi_perspective":
+            return generateMultiPerspectiveScript({});
+        default:
+            return null;
+    }
+}
+/**
+ * Resuelve un workflow por nombre: builtin primero, luego script guardado en
+ * <agentDir>/workflows/<name>.js (extensiones .js/.mjs/.cjs aceptadas).
+ */
+export function resolveWorkflowScriptByName(agentDir, name) {
+    const builtin = resolveBuiltinWorkflowScript(name);
+    if (builtin)
+        return { source: "builtin", name: name.replace(/-/g, "_").toLowerCase(), script: builtin };
+    const base = name.replace(/\.(js|mjs|cjs)$/i, "");
+    for (const ext of ["js", "mjs", "cjs"]) {
+        const filePath = join(agentDir, "workflows", `${base}.${ext}`);
+        try {
+            const script = readFileSync(filePath, "utf-8");
+            return { source: "user-script", name: base, script, filePath };
+        }
+        catch {
+            // siguiente extensión
+        }
+    }
+    return null;
+}
+/** Lista scripts del usuario guardados en <agentDir>/workflows/*.js. */
+export function listUserWorkflowScripts(agentDir) {
+    try {
+        const dir = join(agentDir, "workflows");
+        return readdirSync(dir)
+            .filter((f) => /\.(js|mjs|cjs)$/.test(f) && !f.endsWith(".json"))
+            .map((f) => ({ name: f.replace(/\.(js|mjs|cjs)$/i, ""), filePath: join(dir, f) }));
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=resolve-script.js.map

package/dist/core/workflows/resolve-script.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-script.js","sourceRoot":"","sources":["../../../src/core/workflows/resolve-script.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACN,2BAA2B,EAC3B,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,0BAA0B,GAC1B,MAAM,eAAe,CAAC;AAavB,wDAAwD;AACxD,MAAM,UAAU,4BAA4B,CAAC,IAAY,EAAiB;IACzE,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/C,KAAK,eAAe;YACnB,OAAO,0BAA0B,CAAC,EAAE,CAAC,CAAC;QACvC,KAAK,aAAa;YACjB,OAAO,wBAAwB,CAAC,EAAE,CAAC,CAAC;QACrC,KAAK,eAAe;YACnB,OAAO,0BAA0B,EAAE,CAAC;QACrC,KAAK,gBAAgB;YACpB,OAAO,2BAA2B,CAAC,EAAE,CAAC,CAAC;QACxC,KAAK,mBAAmB;YACvB,OAAO,8BAA8B,CAAC,EAAE,CAAC,CAAC;QAC3C;YACC,OAAO,IAAI,CAAC;IACd,CAAC;AAAA,CACD;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAgB,EAAE,IAAY,EAAgC;IACzG,MAAM,OAAO,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAExG,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAClD,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACR,uBAAsB;QACvB,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CAAC,QAAgB,EAA6C;IACpG,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACxC,OAAO,WAAW,CAAC,GAAG,CAAC;aACrB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;aAChE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;AAAA,CACD","sourcesContent":["/**\n * Resolución de scripts de workflow POR NOMBRE (§16.1).\n *\n * Orden de resolución:\n *   1. Builtin versionado con el SDK (deep_research, code_review, …).\n *   2. Script guardado por el usuario: <agentDir>/workflows/<name>.js\n *      (cualquier JS con la API del runtime: agent/parallel/pipeline/phase/\n *      store/checkpoint/args/cwd/runId/log — scripts DINÁMICOS completos).\n *\n * Un solo punto de verdad para CLI (/workflow), RPC (desktop), la tool\n * `workflow` del agente y el SDK.\n */\n\nimport { readdirSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport {\n\tgenerateCodebaseAuditScript,\n\tgenerateCodeReviewScript,\n\tgenerateDeepResearchScript,\n\tgenerateMultiPerspectiveScript,\n\tgenerateProductBuildScript,\n} from \"./builtins.ts\";\n\nexport interface ResolveWorkflowResult {\n\t/** Fuente del script: \"builtin\" | \"user-script\". */\n\tsource: \"builtin\" | \"user-script\";\n\t/** Nombre canónico (el del archivo o el builtin). */\n\tname: string;\n\t/** Contenido del script listo para runWorkflow. */\n\tscript: string;\n\t/** Ruta del archivo si es user-script. */\n\tfilePath?: string;\n}\n\n/** Resuelve un builtin por nombre; null si no lo es. */\nexport function resolveBuiltinWorkflowScript(name: string): string | null {\n\tswitch (name.replace(/-/g, \"_\").toLowerCase()) {\n\t\tcase \"deep_research\":\n\t\t\treturn generateDeepResearchScript({});\n\t\tcase \"code_review\":\n\t\t\treturn generateCodeReviewScript({});\n\t\tcase \"product_build\":\n\t\t\treturn generateProductBuildScript();\n\t\tcase \"codebase_audit\":\n\t\t\treturn generateCodebaseAuditScript({});\n\t\tcase \"multi_perspective\":\n\t\t\treturn generateMultiPerspectiveScript({});\n\t\tdefault:\n\t\t\treturn null;\n\t}\n}\n\n/**\n * Resuelve un workflow por nombre: builtin primero, luego script guardado en\n * <agentDir>/workflows/<name>.js (extensiones .js/.mjs/.cjs aceptadas).\n */\nexport function resolveWorkflowScriptByName(agentDir: string, name: string): ResolveWorkflowResult | null {\n\tconst builtin = resolveBuiltinWorkflowScript(name);\n\tif (builtin) return { source: \"builtin\", name: name.replace(/-/g, \"_\").toLowerCase(), script: builtin };\n\n\tconst base = name.replace(/\\.(js|mjs|cjs)$/i, \"\");\n\tfor (const ext of [\"js\", \"mjs\", \"cjs\"]) {\n\t\tconst filePath = join(agentDir, \"workflows\", `${base}.${ext}`);\n\t\ttry {\n\t\t\tconst script = readFileSync(filePath, \"utf-8\");\n\t\t\treturn { source: \"user-script\", name: base, script, filePath };\n\t\t} catch {\n\t\t\t// siguiente extensión\n\t\t}\n\t}\n\treturn null;\n}\n\n/** Lista scripts del usuario guardados en <agentDir>/workflows/*.js. */\nexport function listUserWorkflowScripts(agentDir: string): Array<{ name: string; filePath: string }> {\n\ttry {\n\t\tconst dir = join(agentDir, \"workflows\");\n\t\treturn readdirSync(dir)\n\t\t\t.filter((f) => /\\.(js|mjs|cjs)$/.test(f) && !f.endsWith(\".json\"))\n\t\t\t.map((f) => ({ name: f.replace(/\\.(js|mjs|cjs)$/i, \"\"), filePath: join(dir, f) }));\n\t} catch {\n\t\treturn [];\n\t}\n}\n"]}

package/dist/core/workflows/runtime.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Workflow runtime — ejecuta scripts de workflow en un sandbox vm.
+ *
+ * El script es un módulo ESM con `export const meta = {...}` y el cuerpo
+ * (async). El vm recibe SOLO la API del workflow (agent/parallel/pipeline/
+ * store/phase/checkpoint/args/cwd/runId/log) — sin process/require/fs/fetch
+ * (sandbox; la red solo via tools de agente). Determinismo: Math.random y
+ * Date.now se neutralizan en el realm (resume estable). No se inyectan host
+ * built-ins (su .constructor sería el host Function — bypass del guard).
+ */
+import { agentIdentityHash, type CreateSubagentSession } from "./agent-runner.ts";
+import type { HallazgoParcial } from "./contrato/yield.ts";
+import { type WorkflowErrorCode, type WorkflowLimits, type WorkflowMeta, type WorkflowRunResult } from "./types.ts";
+export interface WorkflowRuntimeOptions {
+    cwd: string;
+    agentDir: string;
+    createSession: CreateSubagentSession;
+    limits?: Partial<WorkflowLimits>;
+    resumeJournal?: Map<string, JournalEntryLike>;
+    /**
+     * Se llama tras cada agente ejecutado (no tras un hit de caché). Sin esto el
+     * journal nunca se rellenaba: la ruta de resume estaba escrita y testeada del
+     * lado consumidor, pero nadie producía las entradas.
+     */
+    onJournalEntry?: (entry: {
+        index: number;
+        hash: string;
+        result: unknown;
+    }) => void;
+    onAgentStart?: (index: number, label: string, phase: string | undefined) => void;
+    onAgentEnd?: (index: number, label: string, result: unknown, usage: unknown) => void;
+    /** Se llama EN CUANTO un subagente entrega un hallazgo con `yield` — antes de que termine (contrato/yield.ts). */
+    onAgentYield?: (index: number, label: string, hallazgo: HallazgoParcial) => void;
+    onPhase?: (title: string) => void;
+    onLog?: (message: string) => void;
+    onTokenUsage?: (usage: unknown) => void;
+    confirm?: (prompt: string, options: unknown) => Promise<unknown>;
+    args?: Record<string, unknown>;
+    signal?: AbortSignal;
+    /** runId fijo para resume (mismo run). Default: generado. */
+    runId?: string;
+}
+export interface JournalEntryLike {
+    hash: string;
+    result: unknown;
+    storeDelta?: Record<string, unknown>;
+}
+/** Limiter de concurrencia (semáforo simple). */
+export declare function createLimiter(maxConcurrent: number): <T>(fn: () => Promise<T>) => Promise<T>;
+/**
+ * Extrae `export const meta = {...}` del script: devuelve { meta, body }.
+ * Fallo con WORKFLOW_INVALID_SCRIPT si no hay meta o el JS no balancea.
+ */
+export declare function parseWorkflowScript(script: string): {
+    meta: WorkflowMeta;
+    body: string;
+};
+export declare function runWorkflow<T = unknown>(script: string, options: WorkflowRuntimeOptions): Promise<WorkflowRunResult<T>>;
+/** Re-export del hash para journaling externo. */
+export { agentIdentityHash };
+export type { WorkflowErrorCode };
+//# sourceMappingURL=runtime.d.ts.map

package/dist/core/workflows/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/core/workflows/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,EAAe,iBAAiB,EAAE,KAAK,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAIN,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,MAAM,YAAY,CAAC;AAUpB,MAAM,WAAW,sBAAsB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,qBAAqB,CAAC;IACrC,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;IACnF,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC;IACjF,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACrF,oHAAkH;IAClH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,KAAK,IAAI,CAAC;IACjF,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IACxC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED,kDAAiD;AACjD,wBAAgB,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAe5F;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAuFxF;AAED,wBAAsB,WAAW,CAAC,CAAC,GAAG,OAAO,EAC5C,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,sBAAsB,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CA4R/B;AAED,kDAAkD;AAClD,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC7B,YAAY,EAAE,iBAAiB,EAAE,CAAC","sourcesContent":["/**\n * Workflow runtime — ejecuta scripts de workflow en un sandbox vm.\n *\n * El script es un módulo ESM con `export const meta = {...}` y el cuerpo\n * (async). El vm recibe SOLO la API del workflow (agent/parallel/pipeline/\n * store/phase/checkpoint/args/cwd/runId/log) — sin process/require/fs/fetch\n * (sandbox; la red solo via tools de agente). Determinismo: Math.random y\n * Date.now se neutralizan en el realm (resume estable). No se inyectan host\n * built-ins (su .constructor sería el host Function — bypass del guard).\n */\n\nimport vm from \"node:vm\";\nimport type { TSchema } from \"typebox\";\nimport { CONFIG_DIR_NAME } from \"../../config.ts\";\nimport { aOpcionesDeAgente, cargarAgentes } from \"../agents/loader.ts\";\nimport { hasTrustRequiringProjectResources, ProjectTrustStore } from \"../trust-manager.ts\";\nimport { AgentRunner, agentIdentityHash, type CreateSubagentSession } from \"./agent-runner.ts\";\nimport type { HallazgoParcial } from \"./contrato/yield.ts\";\nimport { SharedStore } from \"./shared-store.ts\";\nimport {\n\tDEFAULT_WORKFLOW_LIMITS,\n\ttype WorkflowApi,\n\tWorkflowError,\n\ttype WorkflowErrorCode,\n\ttype WorkflowLimits,\n\ttype WorkflowMeta,\n\ttype WorkflowRunResult,\n} from \"./types.ts\";\n\nconst _DETERMINISM_PRELUDE = `\n  Math.random = () => { throw new Error(\"Math.random is disabled for workflow determinism\"); };\n  Date.now = () => { throw new Error(\"Date.now is disabled for workflow determinism\"); };\n  (globalThis as any).__adaWorkflowTime = 0;\n`;\n\nconst HOST_BUILTIN_BLOCKLIST = /require\\s*\\(|process\\s*\\.|global\\s*\\.\\s*process|import\\s*\\(/;\n\nexport interface WorkflowRuntimeOptions {\n\tcwd: string;\n\tagentDir: string;\n\tcreateSession: CreateSubagentSession;\n\tlimits?: Partial<WorkflowLimits>;\n\tresumeJournal?: Map<string, JournalEntryLike>;\n\t/**\n\t * Se llama tras cada agente ejecutado (no tras un hit de caché). Sin esto el\n\t * journal nunca se rellenaba: la ruta de resume estaba escrita y testeada del\n\t * lado consumidor, pero nadie producía las entradas.\n\t */\n\tonJournalEntry?: (entry: { index: number; hash: string; result: unknown }) => void;\n\tonAgentStart?: (index: number, label: string, phase: string | undefined) => void;\n\tonAgentEnd?: (index: number, label: string, result: unknown, usage: unknown) => void;\n\t/** Se llama EN CUANTO un subagente entrega un hallazgo con `yield` — antes de que termine (contrato/yield.ts). */\n\tonAgentYield?: (index: number, label: string, hallazgo: HallazgoParcial) => void;\n\tonPhase?: (title: string) => void;\n\tonLog?: (message: string) => void;\n\tonTokenUsage?: (usage: unknown) => void;\n\tconfirm?: (prompt: string, options: unknown) => Promise<unknown>;\n\targs?: Record<string, unknown>;\n\tsignal?: AbortSignal;\n\t/** runId fijo para resume (mismo run). Default: generado. */\n\trunId?: string;\n}\n\nexport interface JournalEntryLike {\n\thash: string;\n\tresult: unknown;\n\tstoreDelta?: Record<string, unknown>;\n}\n\n/** Limiter de concurrencia (semáforo simple). */\nexport function createLimiter(maxConcurrent: number): <T>(fn: () => Promise<T>) => Promise<T> {\n\tlet active = 0;\n\tconst queue: Array<() => void> = [];\n\treturn async <T>(fn: () => Promise<T>): Promise<T> => {\n\t\tif (active >= maxConcurrent) {\n\t\t\tawait new Promise<void>((resolve) => queue.push(resolve));\n\t\t}\n\t\tactive++;\n\t\ttry {\n\t\t\treturn await fn();\n\t\t} finally {\n\t\t\tactive--;\n\t\t\tqueue.shift()?.();\n\t\t}\n\t};\n}\n\n/**\n * Extrae `export const meta = {...}` del script: devuelve { meta, body }.\n * Fallo con WORKFLOW_INVALID_SCRIPT si no hay meta o el JS no balancea.\n */\nexport function parseWorkflowScript(script: string): { meta: WorkflowMeta; body: string } {\n\t// ESTO NO ES UNA FRONTERA DE SEGURIDAD, y decir lo contrario nos costaría la\n\t// credibilidad delante de un evaluador.\n\t//\n\t// La lista negra es una expresión regular sobre el TEXTO del guion, así que\n\t// solo para al que escribe `process.` o `require(` literalmente. El escape\n\t// clásico de `node:vm` por la cadena de constructores la atraviesa entera.\n\t// Medido ejecutándolo:\n\t//\n\t//   const real = this.constructor.constructor(\"return process\")();\n\t//   → {\"pid\":80212,\"envs\":67,\"cwd\":\"/Users/…/packages/coding-agent\"}\n\t//\n\t// El propio Node lo dice en su documentación: «The node:vm module is not a\n\t// security mechanism. Do not use it to run untrusted code.»\n\t//\n\t// Lo que SÍ hace esto, y es lo único que se puede prometer: atrapar el acceso\n\t// ingenuo al host —el guion que un modelo escribe sin mala intención porque\n\t// está acostumbrado a Node— y convertirlo en un error legible en vez de en un\n\t// comportamiento raro. Para código de orquestación NO CONFIABLE la respuesta\n\t// es un contenedor, no esto.\n\t//\n\t// La guarda de este límite está en `test/workflows-sandbox-limite.test.ts`: si\n\t// alguien sustituye `node:vm` por un aislador de verdad, esa prueba se pondrá\n\t// roja y habrá que reescribir esta advertencia. Es el orden correcto.\n\tif (HOST_BUILTIN_BLOCKLIST.test(script)) {\n\t\tthrow new WorkflowError(\n\t\t\t\"WORKFLOW_INVALID_SCRIPT\",\n\t\t\t\"El guion usa require/process/import, que no están disponibles en el intérprete de workflows. \" +\n\t\t\t\t\"Usa los enlaces del guion (agent, parallel, pipeline, log). Aviso: este filtro atrapa el acceso \" +\n\t\t\t\t\"ingenuo al host, NO es un aislamiento de seguridad — para código no confiable, contenedor.\",\n\t\t\t{ recoverable: false },\n\t\t);\n\t}\n\tconst match = /export\\s+const\\s+meta\\s*=\\s*({)/m.exec(script);\n\tif (!match) {\n\t\tthrow new WorkflowError(\"WORKFLOW_INVALID_SCRIPT\", \"Script must export `const meta = {...}`\", {\n\t\t\trecoverable: false,\n\t\t});\n\t}\n\t// Extraer el objeto JSON con llaves balanceadas (el regex no-greedy falla con objetos anidados).\n\tconst start = match.index + match[0].length - 1;\n\tlet depth = 0;\n\tlet end = -1;\n\tlet inString = false;\n\tlet escaped = false;\n\tfor (let i = start; i < script.length; i++) {\n\t\tconst ch = script[i];\n\t\tif (inString) {\n\t\t\tif (escaped) escaped = false;\n\t\t\telse if (ch === \"\\\\\") escaped = true;\n\t\t\telse if (ch === '\"') inString = false;\n\t\t\tcontinue;\n\t\t}\n\t\tif (ch === '\"') inString = true;\n\t\telse if (ch === \"{\") depth++;\n\t\telse if (ch === \"}\") {\n\t\t\tdepth--;\n\t\t\tif (depth === 0) {\n\t\t\t\tend = i;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t}\n\tif (end === -1) {\n\t\tthrow new WorkflowError(\"WORKFLOW_INVALID_SCRIPT\", \"meta object is not closed\", { recoverable: false });\n\t}\n\tconst metaSource = script.slice(start, end + 1);\n\tlet meta: WorkflowMeta;\n\ttry {\n\t\tmeta = JSON.parse(metaSource) as WorkflowMeta;\n\t} catch {\n\t\tthrow new WorkflowError(\n\t\t\t\"WORKFLOW_INVALID_SCRIPT\",\n\t\t\t\"meta is not valid JSON — use plain JSON (no functions/comments)\",\n\t\t\t{\n\t\t\t\trecoverable: false,\n\t\t\t},\n\t\t);\n\t}\n\tif (!meta.name || !meta.description) {\n\t\tthrow new WorkflowError(\"WORKFLOW_INVALID_SCRIPT\", \"meta requires name and description\", { recoverable: false });\n\t}\n\tconst body = script.slice(end + 1).trim();\n\tif (!body) {\n\t\tthrow new WorkflowError(\"WORKFLOW_INVALID_SCRIPT\", \"Script has no body\", { recoverable: false });\n\t}\n\treturn { meta, body };\n}\n\nexport async function runWorkflow<T = unknown>(\n\tscript: string,\n\toptions: WorkflowRuntimeOptions,\n): Promise<WorkflowRunResult<T>> {\n\tconst limits: WorkflowLimits = { ...DEFAULT_WORKFLOW_LIMITS, ...options.limits };\n\tconst { meta, body } = parseWorkflowScript(script);\n\n\tconst runId = options.runId ?? `wf-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;\n\tconst store = new SharedStore();\n\tconst agentCounter = { count: 0 };\n\tconst limiter = createLimiter(limits.maxConcurrency);\n\tconst runner = new AgentRunner({\n\t\tagentDir: options.agentDir,\n\t\tcreateSession: options.createSession,\n\t\tlimiter,\n\t\tagentCounter,\n\t\tmaxAgents: limits.maxAgentsPerRun,\n\t\tretries: limits.maxRetries,\n\t\tagentTimeoutMs: limits.agentTimeoutMs,\n\t});\n\n\tconst logs: string[] = [];\n\tconst phases: string[] = [];\n\tlet callIndex = 0;\n\tconst tokenUsage = { input: 0, output: 0, total: 0, cost: 0, cacheRead: 0, cacheWrite: 0 };\n\tconst started = Date.now();\n\n\tconst log = (message: string) => {\n\t\tlogs.push(message);\n\t\toptions.onLog?.(message);\n\t};\n\n\t// Se cargan una vez por run y se memoriza: un workflow con cien agentes no\n\t// puede leer el disco cien veces.\n\tlet agentesDefinidos: ReturnType<typeof cargarAgentes>[\"agentes\"] | null = null;\n\tconst resolverAgentesDefinidos = () => {\n\t\tif (agentesDefinidos) return agentesDefinidos;\n\t\t// Los de proyecto solo cuentan si el proyecto es de confianza: vienen del\n\t\t// repositorio, igual que una extensión.\n\t\tconst requiere = hasTrustRequiringProjectResources(options.cwd);\n\t\tconst carga = cargarAgentes({\n\t\t\tagentDir: options.agentDir,\n\t\t\tcwd: options.cwd,\n\t\t\tproyectoDeConfianza: !requiere || new ProjectTrustStore(options.agentDir).get(options.cwd) === true,\n\t\t\tconfigDirName: CONFIG_DIR_NAME,\n\t\t});\n\t\tfor (const problema of carga.problemas) {\n\t\t\toptions.onLog?.(`[agents] ${problema.ruta}: ${problema.motivo}`);\n\t\t}\n\t\tif (carga.bloqueadosSinConfianza > 0) {\n\t\t\toptions.onLog?.(\n\t\t\t\t`[agents] ${carga.bloqueadosSinConfianza} agente(s) del proyecto ignorados: el proyecto no es de confianza`,\n\t\t\t);\n\t\t}\n\t\tagentesDefinidos = carga.agentes;\n\t\treturn agentesDefinidos;\n\t};\n\n\tconst agent = async <_TSchemaDef extends TSchema | undefined = undefined>(\n\t\tagentOptions: Parameters<WorkflowApi[\"agent\"]>[0],\n\t) => {\n\t\tconst index = callIndex++;\n\t\toptions.onAgentStart?.(index, agentOptions.label ?? `agent-${index}`, agentOptions.phase);\n\n\t\t// Agentes definidos por el usuario en Markdown. Sus ajustes son la BASE:\n\t\t// lo que el script pase explícitamente gana, para que un workflow pueda\n\t\t// ajustar un agente prestado sin tener que copiarlo entero.\n\t\tif (agentOptions.agentType) {\n\t\t\tconst disponibles = resolverAgentesDefinidos();\n\t\t\tconst definido = disponibles.find((a) => a.nombre === agentOptions.agentType);\n\t\t\tif (!definido) {\n\t\t\t\t// Ignorarlo en silencio dejaría al workflow corriendo con un agente\n\t\t\t\t// genérico creyendo que usa el suyo.\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`agentType '${agentOptions.agentType}' no existe. Disponibles: ${disponibles.map((a) => a.nombre).join(\", \") || \"(ninguno)\"}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tagentOptions = { ...aOpcionesDeAgente(definido), ...agentOptions };\n\t\t}\n\n\t\tconst journalKey = `${runId}:${index}`;\n\t\tconst identityHash = agentIdentityHash({\n\t\t\tprompt: agentOptions.prompt,\n\t\t\tmodel: agentOptions.model,\n\t\t\ttier: agentOptions.tier,\n\t\t\tphase: agentOptions.phase,\n\t\t\tstableKey: agentOptions.stableKey,\n\t\t\tschema: agentOptions.schema,\n\t\t});\n\t\tconst cached = options.resumeJournal?.get(journalKey);\n\t\tif (cached && cached.hash === identityHash) {\n\t\t\tif (cached.storeDelta) store.applyDelta(cached.storeDelta);\n\t\t\toptions.onAgentEnd?.(index, agentOptions.label ?? `agent-${index}`, cached.result, { cached: true });\n\t\t\treturn cached.result;\n\t\t}\n\n\t\tconst label = agentOptions.label ?? `agent-${index}`;\n\t\tconst onYieldDelScript = agentOptions.onYield;\n\t\tconst result = await runner.run({\n\t\t\t...agentOptions,\n\t\t\t// Combina el onYield del propio script (si lo puso) con el del host: los\n\t\t\t// dos quieren enterarse del mismo hallazgo, en el mismo instante.\n\t\t\tonYield: (hallazgo) => {\n\t\t\t\toptions.onAgentYield?.(index, label, hallazgo);\n\t\t\t\tonYieldDelScript?.(hallazgo);\n\t\t\t},\n\t\t\t// Determinista: un resume reencuentra el mismo worktree.\n\t\t\tisolationKey: journalKey.replace(\":\", \"-\"),\n\t\t\tcwd: agentOptions.cwd ?? options.cwd,\n\t\t});\n\t\tif (result === null) return null;\n\n\t\ttokenUsage.input += result.usage.input;\n\t\ttokenUsage.output += result.usage.output;\n\t\ttokenUsage.total += result.usage.total;\n\t\ttokenUsage.cost += result.usage.cost;\n\t\ttokenUsage.cacheRead += result.usage.cacheRead ?? 0;\n\t\ttokenUsage.cacheWrite += result.usage.cacheWrite ?? 0;\n\n\t\t// Journal para el resume: identidad + resultado del agente. NO se guarda\n\t\t// storeDelta a propósito — en este DSL el store lo escribe el SCRIPT, no\n\t\t// los agentes, y al reanudar el script se re-ejecuta entero (con\n\t\t// Math.random/Date.now deshabilitados para que sea determinista), así que\n\t\t// el store se reconstruye solo. Guardar deltas sería estado duplicado.\n\t\toptions.onJournalEntry?.({ index, hash: identityHash, result: result.result });\n\t\toptions.onAgentEnd?.(index, agentOptions.label ?? `agent-${index}`, result.result, result.usage);\n\t\treturn result.result;\n\t};\n\n\tconst parallel = async <R>(fns: Array<() => Promise<R>>): Promise<Array<Awaited<R>>> => {\n\t\treturn Promise.all(fns.map((fn) => fn()));\n\t};\n\n\tconst pipeline = async <R>(fns: Array<(prev?: Awaited<R>) => Promise<R>>): Promise<Awaited<R>> => {\n\t\tlet prev: Awaited<R> | undefined;\n\t\tfor (const fn of fns) {\n\t\t\tprev = await fn(prev);\n\t\t}\n\t\treturn prev as Awaited<R>;\n\t};\n\n\tconst phase = (title: string, detail?: string) => {\n\t\tphases.push(title);\n\t\toptions.onPhase?.(title);\n\t\tif (detail) log(`phase ${title}: ${detail}`);\n\t};\n\n\tconst checkpoint = async <T>(\n\t\tpromptText: string,\n\t\tcheckpointOptions?: {\n\t\t\tdefault?: unknown;\n\t\t\theadless?: \"default\" | \"abort\";\n\t\t\tkind?: \"confirm\" | \"input\" | \"select\";\n\t\t\tchoices?: string[];\n\t\t},\n\t) => {\n\t\tif (options.confirm) {\n\t\t\treturn (await options.confirm(promptText, checkpointOptions)) as T;\n\t\t}\n\t\tif (checkpointOptions?.headless === \"abort\") {\n\t\t\tthrow new WorkflowError(\n\t\t\t\t\"WORKFLOW_ABORTED\",\n\t\t\t\t`checkpoint \"${promptText}\" needs human input but none is available`,\n\t\t\t\t{\n\t\t\t\t\trecoverable: false,\n\t\t\t\t},\n\t\t\t);\n\t\t}\n\t\treturn (checkpointOptions?.default ?? true) as T;\n\t};\n\n\tconst api: WorkflowApi = {\n\t\tagent,\n\t\tparallel,\n\t\tpipeline,\n\t\tphase,\n\t\tstore: {\n\t\t\tput: (k, v) => store.put(k, v),\n\t\t\tget: <U>(k: string) => store.get<U>(k),\n\t\t\thas: (k) => store.has(k),\n\t\t\tdelete: (k) => store.delete(k),\n\t\t\tentries: () => store.entries(),\n\t\t},\n\t\tcheckpoint,\n\t\targs: options.args ?? {},\n\t\tcwd: options.cwd ?? process.cwd(),\n\t\trunId,\n\t\tlog,\n\t};\n\n\tconst context = vm.createContext({\n\t\t...api,\n\t\tObject,\n\t\tArray,\n\t\tJSON,\n\t\tMath: {\n\t\t\t...Math,\n\t\t\trandom: () => {\n\t\t\t\tthrow new Error(\"Math.random disabled\");\n\t\t\t},\n\t\t},\n\t\tDate: { ...Date, now: () => started },\n\t\tPromise,\n\t\tSet,\n\t\tMap,\n\t\tError,\n\t\tString,\n\t\tNumber,\n\t\tBoolean,\n\t\tconsole: {\n\t\t\tlog,\n\t\t\tinfo: log,\n\t\t\twarn: (m: unknown) => log(`[warn] ${String(m)}`),\n\t\t\terror: (m: unknown) => log(`[error] ${String(m)}`),\n\t\t},\n\t\t// Timers: necesarios para esperas cooperativas en scripts (no son acceso\n\t\t// a host — solo programan la cola del event loop).\n\t\tsetTimeout,\n\t\tclearTimeout,\n\t\tsetInterval,\n\t\tclearInterval,\n\t});\n\n\tconst wrapped = `(async () => {\\n${body}\\n})()`;\n\n\tconst scriptTimeout = new Promise<never>((_resolve, reject) => {\n\t\tsetTimeout(() => {\n\t\t\treject(\n\t\t\t\tnew WorkflowError(\"WORKFLOW_SCRIPT_TIMEOUT\", \"Workflow script exceeded its timeout\", {\n\t\t\t\t\trecoverable: false,\n\t\t\t\t}),\n\t\t\t);\n\t\t}, limits.scriptTimeoutMs);\n\t});\n\n\tlet aborted = false;\n\tif (options.signal?.aborted) {\n\t\taborted = true;\n\t} else if (options.signal) {\n\t\toptions.signal.addEventListener(\n\t\t\t\"abort\",\n\t\t\t() => {\n\t\t\t\taborted = true;\n\t\t\t},\n\t\t\t{ once: true },\n\t\t);\n\t}\n\n\t// Notificador de abort: interrumpe el race (≤25ms). El interval se limpia\n\t// SIEMPRE en el finally, así ninguna promesa queda viva tras el run.\n\t// Abort mediante sentinel (nunca rechazo → nunca unhandled).\n\t// El interval se limpia SIEMPRE en el finally.\n\tconst ABORT_SENTINEL = Symbol(\"abort\");\n\tlet abortTimer: ReturnType<typeof setInterval> | undefined;\n\tconst abortNotifier = new Promise<unknown>((resolve) => {\n\t\tabortTimer = setInterval(() => {\n\t\t\tif (aborted) {\n\t\t\t\tclearInterval(abortTimer);\n\t\t\t\tresolve(ABORT_SENTINEL);\n\t\t\t}\n\t\t}, 25);\n\t});\n\n\ttry {\n\t\tconst result = await Promise.race([\n\t\t\tnew vm.Script(wrapped, { filename: `${meta.name || \"workflow\"}.js` }).runInContext(context),\n\t\t\tscriptTimeout,\n\t\t\tabortNotifier,\n\t\t]);\n\t\tif (result === ABORT_SENTINEL) {\n\t\t\tthrow new WorkflowError(\"WORKFLOW_ABORTED\", \"Workflow aborted\", { recoverable: false });\n\t\t}\n\n\t\toptions.onTokenUsage?.(tokenUsage);\n\t\treturn {\n\t\t\tmeta,\n\t\t\tresult: result as T,\n\t\t\tlogs,\n\t\t\tphases,\n\t\t\tagentCount: agentCounter.count,\n\t\t\tdurationMs: Date.now() - started,\n\t\t\trunId,\n\t\t\ttokenUsage,\n\t\t};\n\t} finally {\n\t\tif (abortTimer) clearInterval(abortTimer);\n\t}\n}\n\n/** Re-export del hash para journaling externo. */\nexport { agentIdentityHash };\nexport type { WorkflowErrorCode };\n"]}

package/dist/core/workflows/runtime.js

@@ -0,0 +1,380 @@
+/**
+ * Workflow runtime — ejecuta scripts de workflow en un sandbox vm.
+ *
+ * El script es un módulo ESM con `export const meta = {...}` y el cuerpo
+ * (async). El vm recibe SOLO la API del workflow (agent/parallel/pipeline/
+ * store/phase/checkpoint/args/cwd/runId/log) — sin process/require/fs/fetch
+ * (sandbox; la red solo via tools de agente). Determinismo: Math.random y
+ * Date.now se neutralizan en el realm (resume estable). No se inyectan host
+ * built-ins (su .constructor sería el host Function — bypass del guard).
+ */
+import vm from "node:vm";
+import { CONFIG_DIR_NAME } from "../../config.js";
+import { aOpcionesDeAgente, cargarAgentes } from "../agents/loader.js";
+import { hasTrustRequiringProjectResources, ProjectTrustStore } from "../trust-manager.js";
+import { AgentRunner, agentIdentityHash } from "./agent-runner.js";
+import { SharedStore } from "./shared-store.js";
+import { DEFAULT_WORKFLOW_LIMITS, WorkflowError, } from "./types.js";
+const _DETERMINISM_PRELUDE = `
+  Math.random = () => { throw new Error("Math.random is disabled for workflow determinism"); };
+  Date.now = () => { throw new Error("Date.now is disabled for workflow determinism"); };
+  (globalThis as any).__adaWorkflowTime = 0;
+`;
+const HOST_BUILTIN_BLOCKLIST = /require\s*\(|process\s*\.|global\s*\.\s*process|import\s*\(/;
+/** Limiter de concurrencia (semáforo simple). */
+export function createLimiter(maxConcurrent) {
+    let active = 0;
+    const queue = [];
+    return async (fn) => {
+        if (active >= maxConcurrent) {
+            await new Promise((resolve) => queue.push(resolve));
+        }
+        active++;
+        try {
+            return await fn();
+        }
+        finally {
+            active--;
+            queue.shift()?.();
+        }
+    };
+}
+/**
+ * Extrae `export const meta = {...}` del script: devuelve { meta, body }.
+ * Fallo con WORKFLOW_INVALID_SCRIPT si no hay meta o el JS no balancea.
+ */
+export function parseWorkflowScript(script) {
+    // ESTO NO ES UNA FRONTERA DE SEGURIDAD, y decir lo contrario nos costaría la
+    // credibilidad delante de un evaluador.
+    //
+    // La lista negra es una expresión regular sobre el TEXTO del guion, así que
+    // solo para al que escribe `process.` o `require(` literalmente. El escape
+    // clásico de `node:vm` por la cadena de constructores la atraviesa entera.
+    // Medido ejecutándolo:
+    //
+    //   const real = this.constructor.constructor("return process")();
+    //   → {"pid":80212,"envs":67,"cwd":"/Users/…/packages/coding-agent"}
+    //
+    // El propio Node lo dice en su documentación: «The node:vm module is not a
+    // security mechanism. Do not use it to run untrusted code.»
+    //
+    // Lo que SÍ hace esto, y es lo único que se puede prometer: atrapar el acceso
+    // ingenuo al host —el guion que un modelo escribe sin mala intención porque
+    // está acostumbrado a Node— y convertirlo en un error legible en vez de en un
+    // comportamiento raro. Para código de orquestación NO CONFIABLE la respuesta
+    // es un contenedor, no esto.
+    //
+    // La guarda de este límite está en `test/workflows-sandbox-limite.test.ts`: si
+    // alguien sustituye `node:vm` por un aislador de verdad, esa prueba se pondrá
+    // roja y habrá que reescribir esta advertencia. Es el orden correcto.
+    if (HOST_BUILTIN_BLOCKLIST.test(script)) {
+        throw new WorkflowError("WORKFLOW_INVALID_SCRIPT", "El guion usa require/process/import, que no están disponibles en el intérprete de workflows. " +
+            "Usa los enlaces del guion (agent, parallel, pipeline, log). Aviso: este filtro atrapa el acceso " +
+            "ingenuo al host, NO es un aislamiento de seguridad — para código no confiable, contenedor.", { recoverable: false });
+    }
+    const match = /export\s+const\s+meta\s*=\s*({)/m.exec(script);
+    if (!match) {
+        throw new WorkflowError("WORKFLOW_INVALID_SCRIPT", "Script must export `const meta = {...}`", {
+            recoverable: false,
+        });
+    }
+    // Extraer el objeto JSON con llaves balanceadas (el regex no-greedy falla con objetos anidados).
+    const start = match.index + match[0].length - 1;
+    let depth = 0;
+    let end = -1;
+    let inString = false;
+    let escaped = false;
+    for (let i = start; i < script.length; i++) {
+        const ch = script[i];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (ch === "\\")
+                escaped = true;
+            else if (ch === '"')
+                inString = false;
+            continue;
+        }
+        if (ch === '"')
+            inString = true;
+        else if (ch === "{")
+            depth++;
+        else if (ch === "}") {
+            depth--;
+            if (depth === 0) {
+                end = i;
+                break;
+            }
+        }
+    }
+    if (end === -1) {
+        throw new WorkflowError("WORKFLOW_INVALID_SCRIPT", "meta object is not closed", { recoverable: false });
+    }
+    const metaSource = script.slice(start, end + 1);
+    let meta;
+    try {
+        meta = JSON.parse(metaSource);
+    }
+    catch {
+        throw new WorkflowError("WORKFLOW_INVALID_SCRIPT", "meta is not valid JSON — use plain JSON (no functions/comments)", {
+            recoverable: false,
+        });
+    }
+    if (!meta.name || !meta.description) {
+        throw new WorkflowError("WORKFLOW_INVALID_SCRIPT", "meta requires name and description", { recoverable: false });
+    }
+    const body = script.slice(end + 1).trim();
+    if (!body) {
+        throw new WorkflowError("WORKFLOW_INVALID_SCRIPT", "Script has no body", { recoverable: false });
+    }
+    return { meta, body };
+}
+export async function runWorkflow(script, options) {
+    const limits = { ...DEFAULT_WORKFLOW_LIMITS, ...options.limits };
+    const { meta, body } = parseWorkflowScript(script);
+    const runId = options.runId ?? `wf-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+    const store = new SharedStore();
+    const agentCounter = { count: 0 };
+    const limiter = createLimiter(limits.maxConcurrency);
+    const runner = new AgentRunner({
+        agentDir: options.agentDir,
+        createSession: options.createSession,
+        limiter,
+        agentCounter,
+        maxAgents: limits.maxAgentsPerRun,
+        retries: limits.maxRetries,
+        agentTimeoutMs: limits.agentTimeoutMs,
+    });
+    const logs = [];
+    const phases = [];
+    let callIndex = 0;
+    const tokenUsage = { input: 0, output: 0, total: 0, cost: 0, cacheRead: 0, cacheWrite: 0 };
+    const started = Date.now();
+    const log = (message) => {
+        logs.push(message);
+        options.onLog?.(message);
+    };
+    // Se cargan una vez por run y se memoriza: un workflow con cien agentes no
+    // puede leer el disco cien veces.
+    let agentesDefinidos = null;
+    const resolverAgentesDefinidos = () => {
+        if (agentesDefinidos)
+            return agentesDefinidos;
+        // Los de proyecto solo cuentan si el proyecto es de confianza: vienen del
+        // repositorio, igual que una extensión.
+        const requiere = hasTrustRequiringProjectResources(options.cwd);
+        const carga = cargarAgentes({
+            agentDir: options.agentDir,
+            cwd: options.cwd,
+            proyectoDeConfianza: !requiere || new ProjectTrustStore(options.agentDir).get(options.cwd) === true,
+            configDirName: CONFIG_DIR_NAME,
+        });
+        for (const problema of carga.problemas) {
+            options.onLog?.(`[agents] ${problema.ruta}: ${problema.motivo}`);
+        }
+        if (carga.bloqueadosSinConfianza > 0) {
+            options.onLog?.(`[agents] ${carga.bloqueadosSinConfianza} agente(s) del proyecto ignorados: el proyecto no es de confianza`);
+        }
+        agentesDefinidos = carga.agentes;
+        return agentesDefinidos;
+    };
+    const agent = async (agentOptions) => {
+        const index = callIndex++;
+        options.onAgentStart?.(index, agentOptions.label ?? `agent-${index}`, agentOptions.phase);
+        // Agentes definidos por el usuario en Markdown. Sus ajustes son la BASE:
+        // lo que el script pase explícitamente gana, para que un workflow pueda
+        // ajustar un agente prestado sin tener que copiarlo entero.
+        if (agentOptions.agentType) {
+            const disponibles = resolverAgentesDefinidos();
+            const definido = disponibles.find((a) => a.nombre === agentOptions.agentType);
+            if (!definido) {
+                // Ignorarlo en silencio dejaría al workflow corriendo con un agente
+                // genérico creyendo que usa el suyo.
+                throw new Error(`agentType '${agentOptions.agentType}' no existe. Disponibles: ${disponibles.map((a) => a.nombre).join(", ") || "(ninguno)"}`);
+            }
+            agentOptions = { ...aOpcionesDeAgente(definido), ...agentOptions };
+        }
+        const journalKey = `${runId}:${index}`;
+        const identityHash = agentIdentityHash({
+            prompt: agentOptions.prompt,
+            model: agentOptions.model,
+            tier: agentOptions.tier,
+            phase: agentOptions.phase,
+            stableKey: agentOptions.stableKey,
+            schema: agentOptions.schema,
+        });
+        const cached = options.resumeJournal?.get(journalKey);
+        if (cached && cached.hash === identityHash) {
+            if (cached.storeDelta)
+                store.applyDelta(cached.storeDelta);
+            options.onAgentEnd?.(index, agentOptions.label ?? `agent-${index}`, cached.result, { cached: true });
+            return cached.result;
+        }
+        const label = agentOptions.label ?? `agent-${index}`;
+        const onYieldDelScript = agentOptions.onYield;
+        const result = await runner.run({
+            ...agentOptions,
+            // Combina el onYield del propio script (si lo puso) con el del host: los
+            // dos quieren enterarse del mismo hallazgo, en el mismo instante.
+            onYield: (hallazgo) => {
+                options.onAgentYield?.(index, label, hallazgo);
+                onYieldDelScript?.(hallazgo);
+            },
+            // Determinista: un resume reencuentra el mismo worktree.
+            isolationKey: journalKey.replace(":", "-"),
+            cwd: agentOptions.cwd ?? options.cwd,
+        });
+        if (result === null)
+            return null;
+        tokenUsage.input += result.usage.input;
+        tokenUsage.output += result.usage.output;
+        tokenUsage.total += result.usage.total;
+        tokenUsage.cost += result.usage.cost;
+        tokenUsage.cacheRead += result.usage.cacheRead ?? 0;
+        tokenUsage.cacheWrite += result.usage.cacheWrite ?? 0;
+        // Journal para el resume: identidad + resultado del agente. NO se guarda
+        // storeDelta a propósito — en este DSL el store lo escribe el SCRIPT, no
+        // los agentes, y al reanudar el script se re-ejecuta entero (con
+        // Math.random/Date.now deshabilitados para que sea determinista), así que
+        // el store se reconstruye solo. Guardar deltas sería estado duplicado.
+        options.onJournalEntry?.({ index, hash: identityHash, result: result.result });
+        options.onAgentEnd?.(index, agentOptions.label ?? `agent-${index}`, result.result, result.usage);
+        return result.result;
+    };
+    const parallel = async (fns) => {
+        return Promise.all(fns.map((fn) => fn()));
+    };
+    const pipeline = async (fns) => {
+        let prev;
+        for (const fn of fns) {
+            prev = await fn(prev);
+        }
+        return prev;
+    };
+    const phase = (title, detail) => {
+        phases.push(title);
+        options.onPhase?.(title);
+        if (detail)
+            log(`phase ${title}: ${detail}`);
+    };
+    const checkpoint = async (promptText, checkpointOptions) => {
+        if (options.confirm) {
+            return (await options.confirm(promptText, checkpointOptions));
+        }
+        if (checkpointOptions?.headless === "abort") {
+            throw new WorkflowError("WORKFLOW_ABORTED", `checkpoint "${promptText}" needs human input but none is available`, {
+                recoverable: false,
+            });
+        }
+        return (checkpointOptions?.default ?? true);
+    };
+    const api = {
+        agent,
+        parallel,
+        pipeline,
+        phase,
+        store: {
+            put: (k, v) => store.put(k, v),
+            get: (k) => store.get(k),
+            has: (k) => store.has(k),
+            delete: (k) => store.delete(k),
+            entries: () => store.entries(),
+        },
+        checkpoint,
+        args: options.args ?? {},
+        cwd: options.cwd ?? process.cwd(),
+        runId,
+        log,
+    };
+    const context = vm.createContext({
+        ...api,
+        Object,
+        Array,
+        JSON,
+        Math: {
+            ...Math,
+            random: () => {
+                throw new Error("Math.random disabled");
+            },
+        },
+        Date: { ...Date, now: () => started },
+        Promise,
+        Set,
+        Map,
+        Error,
+        String,
+        Number,
+        Boolean,
+        console: {
+            log,
+            info: log,
+            warn: (m) => log(`[warn] ${String(m)}`),
+            error: (m) => log(`[error] ${String(m)}`),
+        },
+        // Timers: necesarios para esperas cooperativas en scripts (no son acceso
+        // a host — solo programan la cola del event loop).
+        setTimeout,
+        clearTimeout,
+        setInterval,
+        clearInterval,
+    });
+    const wrapped = `(async () => {\n${body}\n})()`;
+    const scriptTimeout = new Promise((_resolve, reject) => {
+        setTimeout(() => {
+            reject(new WorkflowError("WORKFLOW_SCRIPT_TIMEOUT", "Workflow script exceeded its timeout", {
+                recoverable: false,
+            }));
+        }, limits.scriptTimeoutMs);
+    });
+    let aborted = false;
+    if (options.signal?.aborted) {
+        aborted = true;
+    }
+    else if (options.signal) {
+        options.signal.addEventListener("abort", () => {
+            aborted = true;
+        }, { once: true });
+    }
+    // Notificador de abort: interrumpe el race (≤25ms). El interval se limpia
+    // SIEMPRE en el finally, así ninguna promesa queda viva tras el run.
+    // Abort mediante sentinel (nunca rechazo → nunca unhandled).
+    // El interval se limpia SIEMPRE en el finally.
+    const ABORT_SENTINEL = Symbol("abort");
+    let abortTimer;
+    const abortNotifier = new Promise((resolve) => {
+        abortTimer = setInterval(() => {
+            if (aborted) {
+                clearInterval(abortTimer);
+                resolve(ABORT_SENTINEL);
+            }
+        }, 25);
+    });
+    try {
+        const result = await Promise.race([
+            new vm.Script(wrapped, { filename: `${meta.name || "workflow"}.js` }).runInContext(context),
+            scriptTimeout,
+            abortNotifier,
+        ]);
+        if (result === ABORT_SENTINEL) {
+            throw new WorkflowError("WORKFLOW_ABORTED", "Workflow aborted", { recoverable: false });
+        }
+        options.onTokenUsage?.(tokenUsage);
+        return {
+            meta,
+            result: result,
+            logs,
+            phases,
+            agentCount: agentCounter.count,
+            durationMs: Date.now() - started,
+            runId,
+            tokenUsage,
+        };
+    }
+    finally {
+        if (abortTimer)
+            clearInterval(abortTimer);
+    }
+}
+/** Re-export del hash para journaling externo. */
+export { agentIdentityHash };
+//# sourceMappingURL=runtime.js.map

package/dist/core/workflows/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/core/workflows/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,iCAAiC,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAA8B,MAAM,mBAAmB,CAAC;AAE/F,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACN,uBAAuB,EAEvB,aAAa,GAKb,MAAM,YAAY,CAAC;AAEpB,MAAM,oBAAoB,GAAG;;;;CAI5B,CAAC;AAEF,MAAM,sBAAsB,GAAG,6DAA6D,CAAC;AAkC7F,kDAAiD;AACjD,MAAM,UAAU,aAAa,CAAC,aAAqB,EAA2C;IAC7F,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,OAAO,KAAK,EAAK,EAAoB,EAAc,EAAE,CAAC;QACrD,IAAI,MAAM,IAAI,aAAa,EAAE,CAAC;YAC7B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,EAAE,CAAC;QACT,IAAI,CAAC;YACJ,OAAO,MAAM,EAAE,EAAE,CAAC;QACnB,CAAC;gBAAS,CAAC;YACV,MAAM,EAAE,CAAC;YACT,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC;QACnB,CAAC;IAAA,CACD,CAAC;AAAA,CACF;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAwC;IACzF,8EAA6E;IAC7E,wCAAwC;IACxC,EAAE;IACF,8EAA4E;IAC5E,2EAA2E;IAC3E,4EAA2E;IAC3E,wBAAuB;IACvB,EAAE;IACF,mEAAmE;IACnE,yEAAqE;IACrE,EAAE;IACF,6EAA2E;IAC3E,6DAA4D;IAC5D,EAAE;IACF,gFAA8E;IAC9E,+EAA4E;IAC5E,iFAA8E;IAC9E,+EAA6E;IAC7E,6BAA6B;IAC7B,EAAE;IACF,iFAA+E;IAC/E,+EAA8E;IAC9E,uEAAsE;IACtE,IAAI,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,aAAa,CACtB,yBAAyB,EACzB,iGAA+F;YAC9F,kGAAkG;YAClG,+FAA4F,EAC7F,EAAE,WAAW,EAAE,KAAK,EAAE,CACtB,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,yCAAyC,EAAE;YAC7F,WAAW,EAAE,KAAK;SAClB,CAAC,CAAC;IACJ,CAAC;IACD,iGAAiG;IACjG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAChD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;IACb,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,CAAC;iBACxB,IAAI,EAAE,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;iBAChC,IAAI,EAAE,KAAK,GAAG;gBAAE,QAAQ,GAAG,KAAK,CAAC;YACtC,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG;YAAE,QAAQ,GAAG,IAAI,CAAC;aAC3B,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aACxB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACrB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBACjB,GAAG,GAAG,CAAC,CAAC;gBACR,MAAM;YACP,CAAC;QACF,CAAC;IACF,CAAC;IACD,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QAChB,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,2BAA2B,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;IAChD,IAAI,IAAkB,CAAC;IACvB,IAAI,CAAC;QACJ,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAiB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,aAAa,CACtB,yBAAyB,EACzB,mEAAiE,EACjE;YACC,WAAW,EAAE,KAAK;SAClB,CACD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,oCAAoC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE,oBAAoB,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAAA,CACtB;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,MAAc,EACd,OAA+B,EACC;IAChC,MAAM,MAAM,GAAmB,EAAE,GAAG,uBAAuB,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IACjF,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAEnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IACzG,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;IAChC,MAAM,YAAY,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC;QAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,OAAO;QACP,YAAY;QACZ,SAAS,EAAE,MAAM,CAAC,eAAe;QACjC,OAAO,EAAE,MAAM,CAAC,UAAU;QAC1B,cAAc,EAAE,MAAM,CAAC,cAAc;KACrC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,UAAU,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IAC3F,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE3B,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,OAAO,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC;IAAA,CACzB,CAAC;IAEF,2EAA2E;IAC3E,kCAAkC;IAClC,IAAI,gBAAgB,GAAuD,IAAI,CAAC;IAChF,MAAM,wBAAwB,GAAG,GAAG,EAAE,CAAC;QACtC,IAAI,gBAAgB;YAAE,OAAO,gBAAgB,CAAC;QAC9C,0EAA0E;QAC1E,yCAAwC;QACxC,MAAM,QAAQ,GAAG,iCAAiC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,aAAa,CAAC;YAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,mBAAmB,EAAE,CAAC,QAAQ,IAAI,IAAI,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI;YACnG,aAAa,EAAE,eAAe;SAC9B,CAAC,CAAC;QACH,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACxC,OAAO,CAAC,KAAK,EAAE,CAAC,YAAY,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,KAAK,EAAE,CACd,YAAY,KAAK,CAAC,sBAAsB,mEAAmE,CAC3G,CAAC;QACH,CAAC;QACD,gBAAgB,GAAG,KAAK,CAAC,OAAO,CAAC;QACjC,OAAO,gBAAgB,CAAC;IAAA,CACxB,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,EAClB,YAAiD,EAChD,EAAE,CAAC;QACJ,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,IAAI,SAAS,KAAK,EAAE,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAE1F,yEAAyE;QACzE,yEAAwE;QACxE,4DAA4D;QAC5D,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,wBAAwB,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,CAAC,SAAS,CAAC,CAAC;YAC9E,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,qEAAoE;gBACpE,sCAAqC;gBACrC,MAAM,IAAI,KAAK,CACd,cAAc,YAAY,CAAC,SAAS,6BAA6B,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAC7H,CAAC;YACH,CAAC;YACD,YAAY,GAAG,EAAE,GAAG,iBAAiB,CAAC,QAAQ,CAAC,EAAE,GAAG,YAAY,EAAE,CAAC;QACpE,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC;QACvC,MAAM,YAAY,GAAG,iBAAiB,CAAC;YACtC,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,MAAM,EAAE,YAAY,CAAC,MAAM;SAC3B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,UAAU;gBAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAC3D,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,IAAI,SAAS,KAAK,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACrG,OAAO,MAAM,CAAC,MAAM,CAAC;QACtB,CAAC;QAED,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,IAAI,SAAS,KAAK,EAAE,CAAC;QACrD,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC;YAC/B,GAAG,YAAY;YACf,yEAAyE;YACzE,kEAAkE;YAClE,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;gBACtB,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAC/C,gBAAgB,EAAE,CAAC,QAAQ,CAAC,CAAC;YAAA,CAC7B;YACD,yDAAyD;YACzD,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC;YAC1C,GAAG,EAAE,YAAY,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;SACpC,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAEjC,UAAU,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QACvC,UAAU,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QACzC,UAAU,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QACvC,UAAU,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QACrC,UAAU,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC;QACpD,UAAU,CAAC,UAAU,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;QAEtD,yEAAyE;QACzE,4EAAyE;QACzE,iEAAiE;QACjE,2EAA0E;QAC1E,wEAAuE;QACvE,OAAO,CAAC,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,IAAI,SAAS,KAAK,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACjG,OAAO,MAAM,CAAC,MAAM,CAAC;IAAA,CACrB,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAK,GAA4B,EAA8B,EAAE,CAAC;QACvF,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAAA,CAC1C,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAK,GAA6C,EAAuB,EAAE,CAAC;QACjG,IAAI,IAA4B,CAAC;QACjC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACtB,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,IAAkB,CAAC;IAAA,CAC1B,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,MAAe,EAAE,EAAE,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,MAAM;YAAE,GAAG,CAAC,SAAS,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC;IAAA,CAC7C,CAAC;IAEF,MAAM,UAAU,GAAG,KAAK,EACvB,UAAkB,EAClB,iBAKC,EACA,EAAE,CAAC;QACJ,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAM,CAAC;QACpE,CAAC;QACD,IAAI,iBAAiB,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC7C,MAAM,IAAI,aAAa,CACtB,kBAAkB,EAClB,eAAe,UAAU,2CAA2C,EACpE;gBACC,WAAW,EAAE,KAAK;aAClB,CACD,CAAC;QACH,CAAC;QACD,OAAO,CAAC,iBAAiB,EAAE,OAAO,IAAI,IAAI,CAAM,CAAC;IAAA,CACjD,CAAC;IAEF,MAAM,GAAG,GAAgB;QACxB,KAAK;QACL,QAAQ;QACR,QAAQ;QACR,KAAK;QACL,KAAK,EAAE;YACN,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YAC9B,GAAG,EAAE,CAAI,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAI,CAAC,CAAC;YACtC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;YACxB,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9B,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE;SAC9B;QACD,UAAU;QACV,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE;QACxB,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;QACjC,KAAK;QACL,GAAG;KACH,CAAC;IAEF,MAAM,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC;QAChC,GAAG,GAAG;QACN,MAAM;QACN,KAAK;QACL,IAAI;QACJ,IAAI,EAAE;YACL,GAAG,IAAI;YACP,MAAM,EAAE,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAAA,CACxC;SACD;QACD,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE;QACrC,OAAO;QACP,GAAG;QACH,GAAG;QACH,KAAK;QACL,MAAM;QACN,MAAM;QACN,OAAO;QACP,OAAO,EAAE;YACR,GAAG;YACH,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,CAAC,CAAU,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,KAAK,EAAE,CAAC,CAAU,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD;QACD,yEAAyE;QACzE,qDAAmD;QACnD,UAAU;QACV,YAAY;QACZ,WAAW;QACX,aAAa;KACb,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,mBAAmB,IAAI,QAAQ,CAAC;IAEhD,MAAM,aAAa,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC;QAC9D,UAAU,CAAC,GAAG,EAAE,CAAC;YAChB,MAAM,CACL,IAAI,aAAa,CAAC,yBAAyB,EAAE,sCAAsC,EAAE;gBACpF,WAAW,EAAE,KAAK;aAClB,CAAC,CACF,CAAC;QAAA,CACF,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAAA,CAC3B,CAAC,CAAC;IAEH,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAC7B,OAAO,GAAG,IAAI,CAAC;IAChB,CAAC;SAAM,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAC9B,OAAO,EACP,GAAG,EAAE,CAAC;YACL,OAAO,GAAG,IAAI,CAAC;QAAA,CACf,EACD,EAAE,IAAI,EAAE,IAAI,EAAE,CACd,CAAC;IACH,CAAC;IAED,4EAA0E;IAC1E,sEAAqE;IACrE,+DAA6D;IAC7D,+CAA+C;IAC/C,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,UAAsD,CAAC;IAC3D,MAAM,aAAa,GAAG,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACvD,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAC9B,IAAI,OAAO,EAAE,CAAC;gBACb,aAAa,CAAC,UAAU,CAAC,CAAC;gBAC1B,OAAO,CAAC,cAAc,CAAC,CAAC;YACzB,CAAC;QAAA,CACD,EAAE,EAAE,CAAC,CAAC;IAAA,CACP,CAAC,CAAC;IAEH,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACjC,IAAI,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,KAAK,EAAE,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC;YAC3F,aAAa;YACb,aAAa;SACb,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;YAC/B,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,CAAC,CAAC;QACnC,OAAO;YACN,IAAI;YACJ,MAAM,EAAE,MAAW;YACnB,IAAI;YACJ,MAAM;YACN,UAAU,EAAE,YAAY,CAAC,KAAK;YAC9B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;YAChC,KAAK;YACL,UAAU;SACV,CAAC;IACH,CAAC;YAAS,CAAC;QACV,IAAI,UAAU;YAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;AAAA,CACD;AAED,kDAAkD;AAClD,OAAO,EAAE,iBAAiB,EAAE,CAAC","sourcesContent":["/**\n * Workflow runtime — ejecuta scripts de workflow en un sandbox vm.\n *\n * El script es un módulo ESM con `export const meta = {...}` y el cuerpo\n * (async). El vm recibe SOLO la API del workflow (agent/parallel/pipeline/\n * store/phase/checkpoint/args/cwd/runId/log) — sin process/require/fs/fetch\n * (sandbox; la red solo via tools de agente). Determinismo: Math.random y\n * Date.now se neutralizan en el realm (resume estable). No se inyectan host\n * built-ins (su .constructor sería el host Function — bypass del guard).\n */\n\nimport vm from \"node:vm\";\nimport type { TSchema } from \"typebox\";\nimport { CONFIG_DIR_NAME } from \"../../config.ts\";\nimport { aOpcionesDeAgente, cargarAgentes } from \"../agents/loader.ts\";\nimport { hasTrustRequiringProjectResources, ProjectTrustStore } from \"../trust-manager.ts\";\nimport { AgentRunner, agentIdentityHash, type CreateSubagentSession } from \"./agent-runner.ts\";\nimport type { HallazgoParcial } from \"./contrato/yield.ts\";\nimport { SharedStore } from \"./shared-store.ts\";\nimport {\n\tDEFAULT_WORKFLOW_LIMITS,\n\ttype WorkflowApi,\n\tWorkflowError,\n\ttype WorkflowErrorCode,\n\ttype WorkflowLimits,\n\ttype WorkflowMeta,\n\ttype WorkflowRunResult,\n} from \"./types.ts\";\n\nconst _DETERMINISM_PRELUDE = `\n  Math.random = () => { throw new Error(\"Math.random is disabled for workflow determinism\"); };\n  Date.now = () => { throw new Error(\"Date.now is disabled for workflow determinism\"); };\n  (globalThis as any).__adaWorkflowTime = 0;\n`;\n\nconst HOST_BUILTIN_BLOCKLIST = /require\\s*\\(|process\\s*\\.|global\\s*\\.\\s*process|import\\s*\\(/;\n\nexport interface WorkflowRuntimeOptions {\n\tcwd: string;\n\tagentDir: string;\n\tcreateSession: CreateSubagentSession;\n\tlimits?: Partial<WorkflowLimits>;\n\tresumeJournal?: Map<string, JournalEntryLike>;\n\t/**\n\t * Se llama tras cada agente ejecutado (no tras un hit de caché). Sin esto el\n\t * journal nunca se rellenaba: la ruta de resume estaba escrita y testeada del\n\t * lado consumidor, pero nadie producía las entradas.\n\t */\n\tonJournalEntry?: (entry: { index: number; hash: string; result: unknown }) => void;\n\tonAgentStart?: (index: number, label: string, phase: string | undefined) => void;\n\tonAgentEnd?: (index: number, label: string, result: unknown, usage: unknown) => void;\n\t/** Se llama EN CUANTO un subagente entrega un hallazgo con `yield` — antes de que termine (contrato/yield.ts). */\n\tonAgentYield?: (index: number, label: string, hallazgo: HallazgoParcial) => void;\n\tonPhase?: (title: string) => void;\n\tonLog?: (message: string) => void;\n\tonTokenUsage?: (usage: unknown) => void;\n\tconfirm?: (prompt: string, options: unknown) => Promise<unknown>;\n\targs?: Record<string, unknown>;\n\tsignal?: AbortSignal;\n\t/** runId fijo para resume (mismo run). Default: generado. */\n\trunId?: string;\n}\n\nexport interface JournalEntryLike {\n\thash: string;\n\tresult: unknown;\n\tstoreDelta?: Record<string, unknown>;\n}\n\n/** Limiter de concurrencia (semáforo simple). */\nexport function createLimiter(maxConcurrent: number): <T>(fn: () => Promise<T>) => Promise<T> {\n\tlet active = 0;\n\tconst queue: Array<() => void> = [];\n\treturn async <T>(fn: () => Promise<T>): Promise<T> => {\n\t\tif (active >= maxConcurrent) {\n\t\t\tawait new Promise<void>((resolve) => queue.push(resolve));\n\t\t}\n\t\tactive++;\n\t\ttry {\n\t\t\treturn await fn();\n\t\t} finally {\n\t\t\tactive--;\n\t\t\tqueue.shift()?.();\n\t\t}\n\t};\n}\n\n/**\n * Extrae `export const meta = {...}` del script: devuelve { meta, body }.\n * Fallo con WORKFLOW_INVALID_SCRIPT si no hay meta o el JS no balancea.\n */\nexport function parseWorkflowScript(script: string): { meta: WorkflowMeta; body: string } {\n\t// ESTO NO ES UNA FRONTERA DE SEGURIDAD, y decir lo contrario nos costaría la\n\t// credibilidad delante de un evaluador.\n\t//\n\t// La lista negra es una expresión regular sobre el TEXTO del guion, así que\n\t// solo para al que escribe `process.` o `require(` literalmente. El escape\n\t// clásico de `node:vm` por la cadena de constructores la atraviesa entera.\n\t// Medido ejecutándolo:\n\t//\n\t//   const real = this.constructor.constructor(\"return process\")();\n\t//   → {\"pid\":80212,\"envs\":67,\"cwd\":\"/Users/…/packages/coding-agent\"}\n\t//\n\t// El propio Node lo dice en su documentación: «The node:vm module is not a\n\t// security mechanism. Do not use it to run untrusted code.»\n\t//\n\t// Lo que SÍ hace esto, y es lo único que se puede prometer: atrapar el acceso\n\t// ingenuo al host —el guion que un modelo escribe sin mala intención porque\n\t// está acostumbrado a Node— y convertirlo en un error legible en vez de en un\n\t// comportamiento raro. Para código de orquestación NO CONFIABLE la respuesta\n\t// es un contenedor, no esto.\n\t//\n\t// La guarda de este límite está en `test/workflows-sandbox-limite.test.ts`: si\n\t// alguien sustituye `node:vm` por un aislador de verdad, esa prueba se pondrá\n\t// roja y habrá que reescribir esta advertencia. Es el orden correcto.\n\tif (HOST_BUILTIN_BLOCKLIST.test(script)) {\n\t\tthrow new WorkflowError(\n\t\t\t\"WORKFLOW_INVALID_SCRIPT\",\n\t\t\t\"El guion usa require/process/import, que no están disponibles en el intérprete de workflows. \" +\n\t\t\t\t\"Usa los enlaces del guion (agent, parallel, pipeline, log). Aviso: este filtro atrapa el acceso \" +\n\t\t\t\t\"ingenuo al host, NO es un aislamiento de seguridad — para código no confiable, contenedor.\",\n\t\t\t{ recoverable: false },\n\t\t);\n\t}\n\tconst match = /export\\s+const\\s+meta\\s*=\\s*({)/m.exec(script);\n\tif (!match) {\n\t\tthrow new WorkflowError(\"WORKFLOW_INVALID_SCRIPT\", \"Script must export `const meta = {...}`\", {\n\t\t\trecoverable: false,\n\t\t});\n\t}\n\t// Extraer el objeto JSON con llaves balanceadas (el regex no-greedy falla con objetos anidados).\n\tconst start = match.index + match[0].length - 1;\n\tlet depth = 0;\n\tlet end = -1;\n\tlet inString = false;\n\tlet escaped = false;\n\tfor (let i = start; i < script.length; i++) {\n\t\tconst ch = script[i];\n\t\tif (inString) {\n\t\t\tif (escaped) escaped = false;\n\t\t\telse if (ch === \"\\\\\") escaped = true;\n\t\t\telse if (ch === '\"') inString = false;\n\t\t\tcontinue;\n\t\t}\n\t\tif (ch === '\"') inString = true;\n\t\telse if (ch === \"{\") depth++;\n\t\telse if (ch === \"}\") {\n\t\t\tdepth--;\n\t\t\tif (depth === 0) {\n\t\t\t\tend = i;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t}\n\tif (end === -1) {\n\t\tthrow new WorkflowError(\"WORKFLOW_INVALID_SCRIPT\", \"meta object is not closed\", { recoverable: false });\n\t}\n\tconst metaSource = script.slice(start, end + 1);\n\tlet meta: WorkflowMeta;\n\ttry {\n\t\tmeta = JSON.parse(metaSource) as WorkflowMeta;\n\t} catch {\n\t\tthrow new WorkflowError(\n\t\t\t\"WORKFLOW_INVALID_SCRIPT\",\n\t\t\t\"meta is not valid JSON — use plain JSON (no functions/comments)\",\n\t\t\t{\n\t\t\t\trecoverable: false,\n\t\t\t},\n\t\t);\n\t}\n\tif (!meta.name || !meta.description) {\n\t\tthrow new WorkflowError(\"WORKFLOW_INVALID_SCRIPT\", \"meta requires name and description\", { recoverable: false });\n\t}\n\tconst body = script.slice(end + 1).trim();\n\tif (!body) {\n\t\tthrow new WorkflowError(\"WORKFLOW_INVALID_SCRIPT\", \"Script has no body\", { recoverable: false });\n\t}\n\treturn { meta, body };\n}\n\nexport async function runWorkflow<T = unknown>(\n\tscript: string,\n\toptions: WorkflowRuntimeOptions,\n): Promise<WorkflowRunResult<T>> {\n\tconst limits: WorkflowLimits = { ...DEFAULT_WORKFLOW_LIMITS, ...options.limits };\n\tconst { meta, body } = parseWorkflowScript(script);\n\n\tconst runId = options.runId ?? `wf-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;\n\tconst store = new SharedStore();\n\tconst agentCounter = { count: 0 };\n\tconst limiter = createLimiter(limits.maxConcurrency);\n\tconst runner = new AgentRunner({\n\t\tagentDir: options.agentDir,\n\t\tcreateSession: options.createSession,\n\t\tlimiter,\n\t\tagentCounter,\n\t\tmaxAgents: limits.maxAgentsPerRun,\n\t\tretries: limits.maxRetries,\n\t\tagentTimeoutMs: limits.agentTimeoutMs,\n\t});\n\n\tconst logs: string[] = [];\n\tconst phases: string[] = [];\n\tlet callIndex = 0;\n\tconst tokenUsage = { input: 0, output: 0, total: 0, cost: 0, cacheRead: 0, cacheWrite: 0 };\n\tconst started = Date.now();\n\n\tconst log = (message: string) => {\n\t\tlogs.push(message);\n\t\toptions.onLog?.(message);\n\t};\n\n\t// Se cargan una vez por run y se memoriza: un workflow con cien agentes no\n\t// puede leer el disco cien veces.\n\tlet agentesDefinidos: ReturnType<typeof cargarAgentes>[\"agentes\"] | null = null;\n\tconst resolverAgentesDefinidos = () => {\n\t\tif (agentesDefinidos) return agentesDefinidos;\n\t\t// Los de proyecto solo cuentan si el proyecto es de confianza: vienen del\n\t\t// repositorio, igual que una extensión.\n\t\tconst requiere = hasTrustRequiringProjectResources(options.cwd);\n\t\tconst carga = cargarAgentes({\n\t\t\tagentDir: options.agentDir,\n\t\t\tcwd: options.cwd,\n\t\t\tproyectoDeConfianza: !requiere || new ProjectTrustStore(options.agentDir).get(options.cwd) === true,\n\t\t\tconfigDirName: CONFIG_DIR_NAME,\n\t\t});\n\t\tfor (const problema of carga.problemas) {\n\t\t\toptions.onLog?.(`[agents] ${problema.ruta}: ${problema.motivo}`);\n\t\t}\n\t\tif (carga.bloqueadosSinConfianza > 0) {\n\t\t\toptions.onLog?.(\n\t\t\t\t`[agents] ${carga.bloqueadosSinConfianza} agente(s) del proyecto ignorados: el proyecto no es de confianza`,\n\t\t\t);\n\t\t}\n\t\tagentesDefinidos = carga.agentes;\n\t\treturn agentesDefinidos;\n\t};\n\n\tconst agent = async <_TSchemaDef extends TSchema | undefined = undefined>(\n\t\tagentOptions: Parameters<WorkflowApi[\"agent\"]>[0],\n\t) => {\n\t\tconst index = callIndex++;\n\t\toptions.onAgentStart?.(index, agentOptions.label ?? `agent-${index}`, agentOptions.phase);\n\n\t\t// Agentes definidos por el usuario en Markdown. Sus ajustes son la BASE:\n\t\t// lo que el script pase explícitamente gana, para que un workflow pueda\n\t\t// ajustar un agente prestado sin tener que copiarlo entero.\n\t\tif (agentOptions.agentType) {\n\t\t\tconst disponibles = resolverAgentesDefinidos();\n\t\t\tconst definido = disponibles.find((a) => a.nombre === agentOptions.agentType);\n\t\t\tif (!definido) {\n\t\t\t\t// Ignorarlo en silencio dejaría al workflow corriendo con un agente\n\t\t\t\t// genérico creyendo que usa el suyo.\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`agentType '${agentOptions.agentType}' no existe. Disponibles: ${disponibles.map((a) => a.nombre).join(\", \") || \"(ninguno)\"}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tagentOptions = { ...aOpcionesDeAgente(definido), ...agentOptions };\n\t\t}\n\n\t\tconst journalKey = `${runId}:${index}`;\n\t\tconst identityHash = agentIdentityHash({\n\t\t\tprompt: agentOptions.prompt,\n\t\t\tmodel: agentOptions.model,\n\t\t\ttier: agentOptions.tier,\n\t\t\tphase: agentOptions.phase,\n\t\t\tstableKey: agentOptions.stableKey,\n\t\t\tschema: agentOptions.schema,\n\t\t});\n\t\tconst cached = options.resumeJournal?.get(journalKey);\n\t\tif (cached && cached.hash === identityHash) {\n\t\t\tif (cached.storeDelta) store.applyDelta(cached.storeDelta);\n\t\t\toptions.onAgentEnd?.(index, agentOptions.label ?? `agent-${index}`, cached.result, { cached: true });\n\t\t\treturn cached.result;\n\t\t}\n\n\t\tconst label = agentOptions.label ?? `agent-${index}`;\n\t\tconst onYieldDelScript = agentOptions.onYield;\n\t\tconst result = await runner.run({\n\t\t\t...agentOptions,\n\t\t\t// Combina el onYield del propio script (si lo puso) con el del host: los\n\t\t\t// dos quieren enterarse del mismo hallazgo, en el mismo instante.\n\t\t\tonYield: (hallazgo) => {\n\t\t\t\toptions.onAgentYield?.(index, label, hallazgo);\n\t\t\t\tonYieldDelScript?.(hallazgo);\n\t\t\t},\n\t\t\t// Determinista: un resume reencuentra el mismo worktree.\n\t\t\tisolationKey: journalKey.replace(\":\", \"-\"),\n\t\t\tcwd: agentOptions.cwd ?? options.cwd,\n\t\t});\n\t\tif (result === null) return null;\n\n\t\ttokenUsage.input += result.usage.input;\n\t\ttokenUsage.output += result.usage.output;\n\t\ttokenUsage.total += result.usage.total;\n\t\ttokenUsage.cost += result.usage.cost;\n\t\ttokenUsage.cacheRead += result.usage.cacheRead ?? 0;\n\t\ttokenUsage.cacheWrite += result.usage.cacheWrite ?? 0;\n\n\t\t// Journal para el resume: identidad + resultado del agente. NO se guarda\n\t\t// storeDelta a propósito — en este DSL el store lo escribe el SCRIPT, no\n\t\t// los agentes, y al reanudar el script se re-ejecuta entero (con\n\t\t// Math.random/Date.now deshabilitados para que sea determinista), así que\n\t\t// el store se reconstruye solo. Guardar deltas sería estado duplicado.\n\t\toptions.onJournalEntry?.({ index, hash: identityHash, result: result.result });\n\t\toptions.onAgentEnd?.(index, agentOptions.label ?? `agent-${index}`, result.result, result.usage);\n\t\treturn result.result;\n\t};\n\n\tconst parallel = async <R>(fns: Array<() => Promise<R>>): Promise<Array<Awaited<R>>> => {\n\t\treturn Promise.all(fns.map((fn) => fn()));\n\t};\n\n\tconst pipeline = async <R>(fns: Array<(prev?: Awaited<R>) => Promise<R>>): Promise<Awaited<R>> => {\n\t\tlet prev: Awaited<R> | undefined;\n\t\tfor (const fn of fns) {\n\t\t\tprev = await fn(prev);\n\t\t}\n\t\treturn prev as Awaited<R>;\n\t};\n\n\tconst phase = (title: string, detail?: string) => {\n\t\tphases.push(title);\n\t\toptions.onPhase?.(title);\n\t\tif (detail) log(`phase ${title}: ${detail}`);\n\t};\n\n\tconst checkpoint = async <T>(\n\t\tpromptText: string,\n\t\tcheckpointOptions?: {\n\t\t\tdefault?: unknown;\n\t\t\theadless?: \"default\" | \"abort\";\n\t\t\tkind?: \"confirm\" | \"input\" | \"select\";\n\t\t\tchoices?: string[];\n\t\t},\n\t) => {\n\t\tif (options.confirm) {\n\t\t\treturn (await options.confirm(promptText, checkpointOptions)) as T;\n\t\t}\n\t\tif (checkpointOptions?.headless === \"abort\") {\n\t\t\tthrow new WorkflowError(\n\t\t\t\t\"WORKFLOW_ABORTED\",\n\t\t\t\t`checkpoint \"${promptText}\" needs human input but none is available`,\n\t\t\t\t{\n\t\t\t\t\trecoverable: false,\n\t\t\t\t},\n\t\t\t);\n\t\t}\n\t\treturn (checkpointOptions?.default ?? true) as T;\n\t};\n\n\tconst api: WorkflowApi = {\n\t\tagent,\n\t\tparallel,\n\t\tpipeline,\n\t\tphase,\n\t\tstore: {\n\t\t\tput: (k, v) => store.put(k, v),\n\t\t\tget: <U>(k: string) => store.get<U>(k),\n\t\t\thas: (k) => store.has(k),\n\t\t\tdelete: (k) => store.delete(k),\n\t\t\tentries: () => store.entries(),\n\t\t},\n\t\tcheckpoint,\n\t\targs: options.args ?? {},\n\t\tcwd: options.cwd ?? process.cwd(),\n\t\trunId,\n\t\tlog,\n\t};\n\n\tconst context = vm.createContext({\n\t\t...api,\n\t\tObject,\n\t\tArray,\n\t\tJSON,\n\t\tMath: {\n\t\t\t...Math,\n\t\t\trandom: () => {\n\t\t\t\tthrow new Error(\"Math.random disabled\");\n\t\t\t},\n\t\t},\n\t\tDate: { ...Date, now: () => started },\n\t\tPromise,\n\t\tSet,\n\t\tMap,\n\t\tError,\n\t\tString,\n\t\tNumber,\n\t\tBoolean,\n\t\tconsole: {\n\t\t\tlog,\n\t\t\tinfo: log,\n\t\t\twarn: (m: unknown) => log(`[warn] ${String(m)}`),\n\t\t\terror: (m: unknown) => log(`[error] ${String(m)}`),\n\t\t},\n\t\t// Timers: necesarios para esperas cooperativas en scripts (no son acceso\n\t\t// a host — solo programan la cola del event loop).\n\t\tsetTimeout,\n\t\tclearTimeout,\n\t\tsetInterval,\n\t\tclearInterval,\n\t});\n\n\tconst wrapped = `(async () => {\\n${body}\\n})()`;\n\n\tconst scriptTimeout = new Promise<never>((_resolve, reject) => {\n\t\tsetTimeout(() => {\n\t\t\treject(\n\t\t\t\tnew WorkflowError(\"WORKFLOW_SCRIPT_TIMEOUT\", \"Workflow script exceeded its timeout\", {\n\t\t\t\t\trecoverable: false,\n\t\t\t\t}),\n\t\t\t);\n\t\t}, limits.scriptTimeoutMs);\n\t});\n\n\tlet aborted = false;\n\tif (options.signal?.aborted) {\n\t\taborted = true;\n\t} else if (options.signal) {\n\t\toptions.signal.addEventListener(\n\t\t\t\"abort\",\n\t\t\t() => {\n\t\t\t\taborted = true;\n\t\t\t},\n\t\t\t{ once: true },\n\t\t);\n\t}\n\n\t// Notificador de abort: interrumpe el race (≤25ms). El interval se limpia\n\t// SIEMPRE en el finally, así ninguna promesa queda viva tras el run.\n\t// Abort mediante sentinel (nunca rechazo → nunca unhandled).\n\t// El interval se limpia SIEMPRE en el finally.\n\tconst ABORT_SENTINEL = Symbol(\"abort\");\n\tlet abortTimer: ReturnType<typeof setInterval> | undefined;\n\tconst abortNotifier = new Promise<unknown>((resolve) => {\n\t\tabortTimer = setInterval(() => {\n\t\t\tif (aborted) {\n\t\t\t\tclearInterval(abortTimer);\n\t\t\t\tresolve(ABORT_SENTINEL);\n\t\t\t}\n\t\t}, 25);\n\t});\n\n\ttry {\n\t\tconst result = await Promise.race([\n\t\t\tnew vm.Script(wrapped, { filename: `${meta.name || \"workflow\"}.js` }).runInContext(context),\n\t\t\tscriptTimeout,\n\t\t\tabortNotifier,\n\t\t]);\n\t\tif (result === ABORT_SENTINEL) {\n\t\t\tthrow new WorkflowError(\"WORKFLOW_ABORTED\", \"Workflow aborted\", { recoverable: false });\n\t\t}\n\n\t\toptions.onTokenUsage?.(tokenUsage);\n\t\treturn {\n\t\t\tmeta,\n\t\t\tresult: result as T,\n\t\t\tlogs,\n\t\t\tphases,\n\t\t\tagentCount: agentCounter.count,\n\t\t\tdurationMs: Date.now() - started,\n\t\t\trunId,\n\t\t\ttokenUsage,\n\t\t};\n\t} finally {\n\t\tif (abortTimer) clearInterval(abortTimer);\n\t}\n}\n\n/** Re-export del hash para journaling externo. */\nexport { agentIdentityHash };\nexport type { WorkflowErrorCode };\n"]}