@langchain/quickjs 1.0.0-alpha.0 → 1.0.0

package/dist/index.cjs

@@ -25,17 +25,37 @@ let langchain = require("langchain");
 let zod_v4 = require("zod/v4");
 let deepagents = require("deepagents");
 let dedent = require("dedent");
-dedent = __toESM(dedent);
+dedent = __toESM(dedent, 1);
 let quickjs_emscripten = require("quickjs-emscripten");
 let quickjs_emscripten_core = require("quickjs-emscripten-core");
 let json_schema_to_typescript = require("json-schema-to-typescript");
 let _langchain_core_utils_json_schema = require("@langchain/core/utils/json_schema");
+let _langchain_langgraph = require("@langchain/langgraph");
+let _langchain_core_messages = require("@langchain/core/messages");
 let acorn = require("acorn");
 let _sveltejs_acorn_typescript = require("@sveltejs/acorn-typescript");
 let estree_walker = require("estree-walker");
 let magic_string = require("magic-string");
-magic_string = __toESM(magic_string);
-let _langchain_langgraph = require("@langchain/langgraph");
+magic_string = __toESM(magic_string, 1);
+let p_queue = require("p-queue");
+p_queue = __toESM(p_queue, 1);
+//#region src/errors.ts
+/**
+* Thrown when a single eval exhausts its configured PTC call budget.
+*/
+var PTCCallBudgetExceededError = class extends Error {
+	limit;
+	attempted;
+	functionName;
+	constructor(options) {
+		super(`PTC call budget exceeded (limit=${options.limit}, attempted=${options.attempted}, function=${options.functionName})`);
+		this.name = "PTCCallBudgetExceededError";
+		this.limit = options.limit;
+		this.attempted = options.attempted;
+		this.functionName = options.functionName;
+	}
+};
+//#endregion
 //#region src/utils.ts
 /**
 * Convert a snake_case or kebab-case string to camelCase.
@@ -48,7 +68,11 @@ function toCamelCase(name) {
 */
 function formatReplResult(result) {
 	const parts = [];
-	if (result.logs.length > 0) parts.push(result.logs.join("\n"));
+	if (result.logs.length > 0) {
+		let logsText = result.logs.join("\n");
+		if (result.logsDroppedChars > 0) logsText += `\n[truncated ${result.logsDroppedChars} chars]`;
+		parts.push(logsText);
+	}
 	if (result.ok) {
 		if (result.value !== void 0) {
 			const formatted = typeof result.value === "string" ? result.value : JSON.stringify(result.value, null, 2);
@@ -99,6 +123,59 @@ async function toolToTypeSignature(name, description, jsonSchema) {
   `;
 }
 //#endregion
+//#region src/coerce.ts
+/**
+* Coercion of tool / subagent return values for the QuickJS bridge.
+*
+* The deepagents `task` tool resolves to a LangGraph `Command` whose payload
+* carries the subagent's final message(s) under `update.messages`; some tools
+* return a `ToolMessage` or a list of messages. The interpreter bridges need
+* the underlying output, not the envelope, so this unwraps those shapes to the
+* content the model actually cares about.
+*/
+/**
+* Return the trailing message content from a `Command`'s `update.messages`,
+* scanning from the end for the last message that actually has content. Returns
+* the command unchanged when it has no message-shaped payload.
+*/
+function extractCommandContent(command) {
+	const update = command.update;
+	const messages = update !== null && typeof update === "object" ? update.messages : void 0;
+	if (Array.isArray(messages)) for (let i = messages.length - 1; i >= 0; i--) {
+		const message = messages[i];
+		if (_langchain_core_messages.BaseMessage.isInstance(message) && message.content != null) return message.content;
+	}
+	return command;
+}
+/**
+* Unwrap a LangChain `Command` / `ToolMessage` / message-list envelope to the
+* underlying content. Non-envelope values (strings, content-block arrays, plain
+* objects) are returned unchanged.
+*
+* @param value The raw value returned by a tool or subagent dispatch.
+* @returns The unwrapped content, or `value` itself when it isn't an envelope.
+*/
+function unwrapToolEnvelope(value) {
+	if (typeof value === "string") return value;
+	if ((0, _langchain_langgraph.isCommand)(value)) {
+		const inner = extractCommandContent(value);
+		return inner === value ? value : unwrapToolEnvelope(inner);
+	}
+	if (_langchain_core_messages.BaseMessage.isInstance(value)) return unwrapToolEnvelope(value.content);
+	if (Array.isArray(value)) {
+		for (let i = value.length - 1; i >= 0; i--) {
+			const entry = value[i];
+			if (_langchain_core_messages.BaseMessage.isInstance(entry)) return unwrapToolEnvelope(entry.content);
+			if ((0, _langchain_langgraph.isCommand)(entry)) {
+				const inner = extractCommandContent(entry);
+				if (inner !== entry) return unwrapToolEnvelope(inner);
+			}
+		}
+		return value;
+	}
+	return value;
+}
+//#endregion
 //#region src/transform.ts
 /**
 * AST-based code transform pipeline for the REPL.
@@ -174,7 +251,11 @@ function transformForEval(code) {
 }
 function isTSOnlyNode(node) {
 	const t = node.type;
-	return t === "TSTypeAliasDeclaration" || t === "TSInterfaceDeclaration" || t === "TSEnumDeclaration" || t === "TSModuleDeclaration" || t === "TSDeclareFunction" || t.startsWith("TS");
+	if (t === "TSTypeAliasDeclaration" || t === "TSInterfaceDeclaration" || t === "TSEnumDeclaration" || t === "TSModuleDeclaration" || t === "TSDeclareFunction" || t.startsWith("TS")) return true;
+	if (t === "VariableDeclaration" && node.declare === true) return true;
+	if (t === "ImportDeclaration" && node.importKind === "type") return true;
+	if (t === "ExportNamedDeclaration" && node.exportKind === "type") return true;
+	return false;
 }
 /**
 * Rewrite a top-level VariableDeclaration to globalThis assignments.
@@ -226,7 +307,11 @@ function stripTypeAnnotations(s, node) {
 	} });
 }
 function stripTypeAnnotationFromNode(s, n, offset = 0) {
-	if (n.typeAnnotation && n.typeAnnotation.start != null) s.remove(n.typeAnnotation.start - offset, n.typeAnnotation.end - offset);
+	if (n.optional === true && n.typeAnnotation && n.typeAnnotation.start != null) s.remove(n.typeAnnotation.start - 1 - offset, n.typeAnnotation.end - offset);
+	else if (n.optional === true && !n.typeAnnotation) {
+		const nameEnd = n.type === "Identifier" && typeof n.name === "string" ? n.start + n.name.length : null;
+		if (nameEnd != null) s.remove(nameEnd - offset, nameEnd + 1 - offset);
+	} else if (n.typeAnnotation && n.typeAnnotation.start != null) s.remove(n.typeAnnotation.start - offset, n.typeAnnotation.end - offset);
 	if (n.returnType && n.returnType.start != null) s.remove(n.returnType.start - offset, n.returnType.end - offset);
 	if (n.typeParameters && n.typeParameters.start != null) s.remove(n.typeParameters.start - offset, n.typeParameters.end - offset);
 	if (n.typeArguments && n.typeArguments.start != null) s.remove(n.typeArguments.start - offset, n.typeArguments.end - offset);
@@ -259,6 +344,70 @@ function findLastNonEmptyNode(nodes, s) {
 function isExpression(node) {
 	return node.type === "ExpressionStatement";
 }
+/**
+* Strip TypeScript type syntax from an ES-module source so QuickJS can
+* evaluate it as a standard JS module.
+*
+* Unlike `transformForEval`, this keeps `import`/`export` declarations,
+* does not hoist to `globalThis`, and does not wrap in an IIFE.
+* On parse failure the original source is returned unchanged.
+*/
+function stripTypeSyntax(code) {
+	let ast;
+	try {
+		ast = TSParser.parse(code, {
+			ecmaVersion: "latest",
+			sourceType: "module",
+			locations: true
+		});
+	} catch {
+		return code;
+	}
+	const magicString = new magic_string.default(code);
+	const program = ast;
+	for (const node of program.body) {
+		if (isTSOnlyNode(node)) {
+			magicString.remove(node.start, node.end);
+			continue;
+		}
+		(0, estree_walker.walk)(node, { enter(n) {
+			stripTypeAnnotationFromNode(magicString, n);
+		} });
+	}
+	return magicString.toString();
+}
+//#endregion
+//#region src/eval-queue.ts
+/**
+* Serializes async operations on a shared WASM module.
+*
+* The quickjs-emscripten asyncify variant allows only one concurrent
+* async call per module instance. This queue enforces that constraint
+* by chaining operations into a promise queue — each caller waits for
+* the previous one to finish before executing.
+*/
+var AsyncEvalQueue = class {
+	tail = Promise.resolve();
+	/**
+	* Enqueue an async operation. The operation will not start until all
+	* previously enqueued operations have completed.
+	*/
+	async enqueue(fn) {
+		let release;
+		const gate = new Promise((r) => {
+			release = r;
+		});
+		const prev = this.tail;
+		this.tail = gate;
+		return prev.then(async () => {
+			try {
+				return await fn();
+			} finally {
+				release();
+			}
+		});
+	}
+};
 //#endregion
 //#region src/session.ts
 /**
@@ -278,65 +427,215 @@ function isExpression(node) {
 * It holds an `id` that keys into a static session map. The heavy QuickJS
 * runtime is lazily started on the first `.eval()` call, making the session
 * safe across graph interrupts and checkpointing.
-*
-* File writes inside the REPL are buffered (`pendingWrites`) and only
-* flushed to the backend after a script finishes executing. Call
-* `session.flushWrites(backend)` after eval to persist them.
 */
-const DEFAULT_MEMORY_LIMIT = 50 * 1024 * 1024;
+const DEFAULT_MEMORY_LIMIT = 64 * 1024 * 1024;
 const DEFAULT_MAX_STACK_SIZE = 320 * 1024;
-const DEFAULT_EXECUTION_TIMEOUT = 3e4;
-let asyncModulePromise;
-async function getAsyncModule() {
-	if (!asyncModulePromise) asyncModulePromise = (async () => {
-		const variant = await import("@jitl/quickjs-ng-wasmfile-release-asyncify");
+const DEFAULT_EXECUTION_TIMEOUT = 5e3;
+const DEFAULT_MAX_PTC_CALLS = 256;
+const DEFAULT_MAX_RESULTS_CHARS = 4e3;
+const LINE_NUMBER_RE = /^\s*\d+(?:\.\d+)?\t/;
+const variantImport = import("@jitl/quickjs-ng-wasmfile-release-asyncify");
+/**
+* Process-global eval queue. Serializes all evalCodeAsync calls across
+* sessions to enforce the asyncify one-at-a-time constraint.
+*/
+const sharedEvalQueue = new AsyncEvalQueue();
+/**
+* Process-global WASM module shared by all sessions.
+*
+* Each session creates its own runtime and context on this module,
+* providing full isolation for globals, heap, and stack. The module
+* itself is stateless between runtimes — only the compiled WASM code
+* and Emscripten infrastructure are shared.
+*
+* This is safe because:
+* - The module loader is synchronous (preloaded skill cache), so
+*   imports don't cause asyncify suspensions.
+* - Tool injection uses the promise-based pattern (newFunction +
+*   newPromise), not newAsyncifiedFunction, so tool calls don't
+*   cause asyncify suspensions.
+* - The eval queue serializes evalCodeAsync calls to satisfy the
+*   one-concurrent-async-call-per-module constraint.
+*/
+let sharedModulePromise;
+function getSharedModule() {
+	if (!sharedModulePromise) sharedModulePromise = (async () => {
+		const variant = await variantImport;
 		return (0, quickjs_emscripten_core.newQuickJSAsyncWASMModuleFromVariant)(variant.default ?? variant);
 	})();
-	return asyncModulePromise;
+	return sharedModulePromise;
+}
+/**
+* Unwrap a PTC tool result to a plain string for use inside QuickJS.
+*
+* Tool results may arrive as a raw string, or as an array of LangChain
+* content blocks (`{ type: "text", text: "..." }`). Blocks are joined
+* with newlines; non-text block types are silently skipped. Anything
+* else (objects, nulls) is JSON-serialised as a fallback.
+*
+* @param result - Raw return value from `tool.invoke()`.
+* @returns Plain string representation of the tool output.
+*/
+function extractToolText(result) {
+	result = unwrapToolEnvelope(result);
+	if (typeof result === "string") return result;
+	if (Array.isArray(result)) {
+		const texts = [];
+		for (const block of result) if (typeof block === "object" && block !== null && block.type === "text" && typeof block.text === "string") texts.push(block.text);
+		if (texts.length > 0) return texts.join("\n");
+	}
+	return JSON.stringify(result);
 }
 /**
+* Remove the `cat -n` line-number prefix from every line of a string.
+*
+* The filesystem backend formats file content with line numbers in the
+* form `"     N\t"` so human readers can navigate by line. That prefix
+* is useful for the agent but noise for QuickJS code that parses the
+* text programmatically (e.g. swarm reading `/context.txt`).
+*
+* The function is conservative: if any non-empty line lacks the prefix,
+* the text is returned unchanged so nothing is silently corrupted.
+*
+* @param text - Raw file content, possibly line-number prefixed.
+* @returns Content with line-number prefixes stripped, or the original
+*          text if it doesn't match the expected format throughout.
+*/
+function stripLineNumbers(text) {
+	const lines = text.split("\n");
+	if (lines.length === 0) return text;
+	if (!lines.every((l) => l === "" || LINE_NUMBER_RE.test(l))) return text;
+	return lines.map((l) => l.replace(LINE_NUMBER_RE, "")).join("\n");
+}
+/**
+* Fixed-size character buffer for capturing console output from the QuickJS VM.
+*
+* Lines are accumulated up to `maxChars`. Once the cap is reached, excess
+* characters are counted as dropped rather than silently discarded without
+* attribution, so callers can surface a truncation notice to the user.
+*/
+var ConsoleBuffer = class {
+	maxChars;
+	buffer = "";
+	droppedChars = 0;
+	constructor(maxChars) {
+		this.maxChars = Math.max(maxChars, 0);
+	}
+	/**
+	* Append `line` to the buffer.
+	*
+	* If the buffer is already full the entire line is counted as dropped.
+	* If `line` partially fits, the fitting prefix is stored and the remainder
+	* is counted as dropped.
+	*/
+	append(line) {
+		const remaining = this.maxChars - this.buffer.length;
+		if (remaining <= 0) {
+			this.droppedChars += line.length;
+			return;
+		}
+		if (line.length <= remaining) this.buffer += line;
+		else {
+			this.buffer += line.slice(0, remaining);
+			this.droppedChars += line.length - remaining;
+		}
+	}
+	/**
+	* Return the buffered output and dropped-character count as `[buffered,
+	* droppedChars]`, then reset both to zero.
+	*/
+	drain() {
+		const out = this.buffer;
+		const dropped = this.droppedChars;
+		this.buffer = "";
+		this.droppedChars = 0;
+		return [out, dropped];
+	}
+};
+/**
 * Sandboxed JavaScript REPL session backed by QuickJS WASM.
 *
 * Serializable — holds an `id` that keys into a static session map.
 * The QuickJS runtime is lazily started on the first `.eval()` call
 * and reconnected if a session with the same id already exists.
 * This makes it safe to store in LangGraph state across interrupts.
-*
-* File writes are buffered during execution and flushed via
-* `flushWrites(backend)` after eval completes.
 */
 var ReplSession = class ReplSession {
 	static sessions = /* @__PURE__ */ new Map();
 	id;
-	pendingWrites = [];
 	runtime = null;
 	context = null;
-	logs = [];
-	_options;
-	_backend = null;
+	consoleBuffer = new ConsoleBuffer(DEFAULT_MAX_RESULTS_CHARS);
+	options;
+	maxPtcCalls;
+	ptcCallsRemaining = null;
+	subagentQueue = null;
+	bridgeDispatchRef = null;
+	/** Allowed keys in the subagent input object. */
+	static SUBAGENT_ALLOWED_KEYS = /* @__PURE__ */ new Set([
+		"description",
+		"subagentType",
+		"responseSchema"
+	]);
+	/**
+	* Reset the shared WASM module. Forces the next session to instantiate
+	* a fresh module. Only needed in tests where module state must be
+	* isolated between test files.
+	*
+	* @internal
+	*/
+	static resetSharedModule() {
+		sharedModulePromise = void 0;
+	}
 	constructor(id, options = {}) {
 		this.id = id;
-		this._options = options;
-	}
-	get backend() {
-		return this._backend;
-	}
-	set backend(b) {
-		this._backend = b ? (0, deepagents.adaptBackendProtocol)(b) : null;
+		this.options = options;
+		this.maxPtcCalls = options.maxPtcCalls !== void 0 ? options.maxPtcCalls : 256;
 	}
 	async ensureStarted() {
 		if (this.runtime) return;
-		const { memoryLimitBytes = DEFAULT_MEMORY_LIMIT, maxStackSizeBytes = DEFAULT_MAX_STACK_SIZE, backend, tools } = this._options;
-		const runtime = (await getAsyncModule()).newRuntime();
+		const { memoryLimitBytes = DEFAULT_MEMORY_LIMIT, maxStackSizeBytes = DEFAULT_MAX_STACK_SIZE, tools, maxResultChars = DEFAULT_MAX_RESULTS_CHARS, captureConsole = true } = this.options;
+		const runtime = (await getSharedModule()).newRuntime();
 		runtime.setMemoryLimit(memoryLimitBytes);
 		runtime.setMaxStackSize(maxStackSizeBytes);
 		const context = runtime.newContext();
 		this.runtime = runtime;
 		this.context = context;
-		this.setupConsole();
-		if (backend) this._backend = (0, deepagents.adaptBackendProtocol)(backend);
-		this.injectVfs();
-		if (tools && tools.length > 0) this.injectTools(tools);
+		this.consoleBuffer = new ConsoleBuffer(maxResultChars);
+		if (captureConsole) this.setupConsole();
+		if (tools !== void 0 && tools.length > 0) this.injectTools(tools);
+		const { subagentBridge } = this.options;
+		if (subagentBridge) {
+			this.subagentQueue = new p_queue.default({ concurrency: subagentBridge.maxConcurrency });
+			this.injectSubagentBridge(subagentBridge.dispatch);
+		}
+		const sessionId = this.options.sessionId ?? "default";
+		const sessionIdHandle = context.newString(sessionId);
+		context.setProp(context.global, "__sessionId__", sessionIdHandle);
+		sessionIdHandle.dispose();
+	}
+	/**
+	* Initialise the per-eval PTC counter. Called at the top of every `eval()`.
+	*/
+	resetPtcBudget() {
+		this.ptcCallsRemaining = this.maxPtcCalls === null ? null : this.maxPtcCalls;
+	}
+	/**
+	* Decrement the PTC call counter and throw if the budget is exhausted.
+	* `null` budget means unlimited — returns immediately without decrementing.
+	*/
+	consumePtcBudget(functionName) {
+		if (this.ptcCallsRemaining === null) return;
+		if (this.ptcCallsRemaining > 0) {
+			this.ptcCallsRemaining--;
+			return;
+		}
+		const limit = this.maxPtcCalls ?? 0;
+		throw new PTCCallBudgetExceededError({
+			limit,
+			attempted: limit + 1,
+			functionName
+		});
 	}
 	/**
 	* Get or create a session for the given id.
@@ -347,10 +646,7 @@ var ReplSession = class ReplSession {
 	*/
 	static getOrCreate(id, options = {}) {
 		const existing = ReplSession.sessions.get(id);
-		if (existing) {
-			if (options.backend) existing._backend = (0, deepagents.adaptBackendProtocol)(options.backend);
-			return existing;
-		}
+		if (existing) return existing;
 		const session = new ReplSession(id, options);
 		ReplSession.sessions.set(id, session);
 		return session;
@@ -362,6 +658,23 @@ var ReplSession = class ReplSession {
 		return ReplSession.sessions.get(id) ?? null;
 	}
 	/**
+	* Returns true if any session exists whose key equals `threadId` or starts
+	* with `threadId:`. Useful for tests that need to confirm a session was
+	* created without knowing the full `threadId:middlewareId` key.
+	*/
+	static hasAnyForThread(threadId) {
+		const prefix = `${threadId}:`;
+		for (const key of ReplSession.sessions.keys()) if (key === threadId || key.startsWith(prefix)) return true;
+		return false;
+	}
+	/**
+	* Dispose and remove the session with the given key, if it exists.
+	*/
+	static deleteSession(key) {
+		const session = ReplSession.sessions.get(key);
+		if (session) session.dispose();
+	}
+	/**
 	* Evaluate code in this session.
 	*
 	* Lazily starts the QuickJS runtime on the first call. Code is
@@ -374,88 +687,94 @@ var ReplSession = class ReplSession {
 		await this.ensureStarted();
 		const runtime = this.runtime;
 		const context = this.context;
-		this.logs.length = 0;
-		if (timeoutMs >= 0) runtime.setInterruptHandler((0, quickjs_emscripten.shouldInterruptAfterDeadline)(Date.now() + timeoutMs));
-		else runtime.setInterruptHandler(() => false);
-		const transformed = transformForEval(code);
-		const result = await context.evalCodeAsync(transformed);
-		if (result.error) {
-			const error = context.dump(result.error);
-			result.error.dispose();
+		const drainLogs = () => {
+			const [raw, dropped] = this.consoleBuffer.drain();
 			return {
-				ok: false,
-				error,
-				logs: [...this.logs]
+				logs: raw.length > 0 ? raw.split("\n").filter((l) => l.length > 0) : [],
+				logsDroppedChars: dropped
 			};
-		}
-		const promiseState = context.getPromiseState(result.value);
-		if (promiseState.type === "fulfilled") {
-			if (promiseState.notAPromise) {
-				const value = context.dump(result.value);
-				result.value.dispose();
+		};
+		this.resetPtcBudget();
+		try {
+			if (timeoutMs >= 0) runtime.setInterruptHandler((0, quickjs_emscripten.shouldInterruptAfterDeadline)(Date.now() + timeoutMs));
+			else runtime.setInterruptHandler(() => false);
+			const transformed = transformForEval(code);
+			const result = await sharedEvalQueue.enqueue(() => context.evalCodeAsync(transformed));
+			if (result.error) {
+				const error = context.dump(result.error);
+				result.error.dispose();
 				return {
-					ok: true,
-					value,
-					logs: [...this.logs]
+					ok: false,
+					error,
+					...drainLogs()
 				};
 			}
-			const value = context.dump(promiseState.value);
-			promiseState.value.dispose();
-			result.value.dispose();
-			return {
-				ok: true,
-				value,
-				logs: [...this.logs]
-			};
-		}
-		if (promiseState.type === "rejected") {
-			const error = context.dump(promiseState.error);
-			promiseState.error.dispose();
-			result.value.dispose();
-			return {
-				ok: false,
-				error,
-				logs: [...this.logs]
-			};
-		}
-		const noTimeout = timeoutMs < 0;
-		const deadline = noTimeout ? Infinity : Date.now() + timeoutMs;
-		while (noTimeout || Date.now() < deadline) {
-			context.runtime.executePendingJobs();
-			const state = context.getPromiseState(result.value);
-			if (state.type === "fulfilled") {
-				const value = context.dump(state.value);
-				state.value.dispose();
+			const promiseState = context.getPromiseState(result.value);
+			if (promiseState.type === "fulfilled") {
+				if (promiseState.notAPromise) {
+					const value = context.dump(result.value);
+					result.value.dispose();
+					return {
+						ok: true,
+						value,
+						...drainLogs()
+					};
+				}
+				const value = context.dump(promiseState.value);
+				promiseState.value.dispose();
 				result.value.dispose();
 				return {
 					ok: true,
 					value,
-					logs: [...this.logs]
+					...drainLogs()
 				};
 			}
-			if (state.type === "rejected") {
-				const error = context.dump(state.error);
-				state.error.dispose();
+			if (promiseState.type === "rejected") {
+				const error = context.dump(promiseState.error);
+				promiseState.error.dispose();
 				result.value.dispose();
 				return {
 					ok: false,
 					error,
-					logs: [...this.logs]
+					...drainLogs()
 				};
 			}
-			await new Promise((r) => setTimeout(r, 1));
+			const noTimeout = timeoutMs < 0;
+			const deadline = noTimeout ? Infinity : Date.now() + timeoutMs;
+			while (noTimeout || Date.now() < deadline) {
+				context.runtime.executePendingJobs();
+				const state = context.getPromiseState(result.value);
+				if (state.type === "fulfilled") {
+					const value = context.dump(state.value);
+					state.value.dispose();
+					result.value.dispose();
+					return {
+						ok: true,
+						value,
+						...drainLogs()
+					};
+				}
+				if (state.type === "rejected") {
+					const error = context.dump(state.error);
+					state.error.dispose();
+					result.value.dispose();
+					return {
+						ok: false,
+						error,
+						...drainLogs()
+					};
+				}
+				await new Promise((r) => setTimeout(r, 1));
+			}
+			result.value.dispose();
+			return {
+				ok: false,
+				error: { message: "Promise timed out — execution interrupted" },
+				...drainLogs()
+			};
+		} finally {
+			this.ptcCallsRemaining = null;
 		}
-		result.value.dispose();
-		return {
-			ok: false,
-			error: { message: "Promise timed out — execution interrupted" },
-			logs: [...this.logs]
-		};
-	}
-	async flushWrites(backend) {
-		const adapted = (0, deepagents.adaptBackendProtocol)(backend);
-		const writes = this.pendingWrites.splice(0);
-		for (const { path, content } of writes) await adapted.write(path, content);
 	}
 	dispose() {
 		try {
@@ -484,7 +803,6 @@ var ReplSession = class ReplSession {
 	}
 	setupConsole() {
 		const context = this.context;
-		const logs = this.logs;
 		const consoleHandle = context.newObject();
 		for (const method of [
 			"log",
@@ -495,7 +813,8 @@ var ReplSession = class ReplSession {
 		]) {
 			const fnHandle = context.newFunction(method, (...args) => {
 				const formatted = args.map((a) => context.dump(a)).map((a) => typeof a === "object" && a !== null ? JSON.stringify(a) : String(a)).join(" ");
-				logs.push(method === "log" || method === "info" || method === "debug" ? formatted : `[${method}] ${formatted}`);
+				const line = method === "log" || method === "info" || method === "debug" ? formatted : `[${method}] ${formatted}`;
+				this.consoleBuffer.append(line + "\n");
 			});
 			context.setProp(consoleHandle, method, fnHandle);
 			fnHandle.dispose();
@@ -503,67 +822,6 @@ var ReplSession = class ReplSession {
 		context.setProp(context.global, "console", consoleHandle);
 		consoleHandle.dispose();
 	}
-	injectVfs() {
-		const context = this.context;
-		const getBackend = () => this._backend;
-		const { pendingWrites } = this;
-		const readFileHandle = context.newFunction("readFile", (pathHandle) => {
-			const backend = getBackend();
-			if (!backend) {
-				const promise = context.newPromise();
-				const err = context.newError("Backend not available");
-				promise.reject(err);
-				err.dispose();
-				promise.settled.then(context.runtime.executePendingJobs);
-				return promise.handle;
-			}
-			const path = context.getString(pathHandle);
-			const promise = context.newPromise();
-			(async () => {
-				try {
-					const result = await backend.readRaw(path);
-					if (result.error || !result.data) {
-						const err = context.newError(`ENOENT: no such file or directory '${path}'.`);
-						promise.reject(err);
-						err.dispose();
-					} else {
-						const content = Array.isArray(result.data.content) ? result.data.content.join("\n") : typeof result.data.content === "string" ? result.data.content : null;
-						if (content === null) {
-							const err = context.newError(`Cannot read binary file '${path}' as text.`);
-							promise.reject(err);
-							err.dispose();
-							return;
-						}
-						const val = context.newString(content);
-						promise.resolve(val);
-						val.dispose();
-					}
-				} catch {
-					const err = context.newError(`ENOENT: no such file or directory '${path}'.`);
-					promise.reject(err);
-					err.dispose();
-				}
-				promise.settled.then(context.runtime.executePendingJobs);
-			})();
-			return promise.handle;
-		});
-		context.setProp(context.global, "readFile", readFileHandle);
-		readFileHandle.dispose();
-		const writeFileHandle = context.newFunction("writeFile", (pathHandle, contentHandle) => {
-			const path = context.getString(pathHandle);
-			const content = context.getString(contentHandle);
-			const promise = context.newPromise();
-			pendingWrites.push({
-				path,
-				content
-			});
-			promise.resolve(context.undefined);
-			promise.settled.then(context.runtime.executePendingJobs);
-			return promise.handle;
-		});
-		context.setProp(context.global, "writeFile", writeFileHandle);
-		writeFileHandle.dispose();
-	}
 	injectTools(tools) {
 		const context = this.context;
 		const toolsNs = context.newObject();
@@ -574,9 +832,11 @@ var ReplSession = class ReplSession {
 				const promise = context.newPromise();
 				(async () => {
 					try {
+						this.consumePtcBudget(camelName);
 						const rawInput = typeof input === "object" && input !== null ? input : {};
-						const result = await t.invoke(rawInput);
-						const val = context.newString(typeof result === "string" ? result : JSON.stringify(result));
+						let text = extractToolText(await t.invoke(rawInput));
+						if (t.name === "read_file") text = stripLineNumbers(text);
+						const val = context.newString(text);
 						promise.resolve(val);
 						val.dispose();
 					} catch (e) {
@@ -595,78 +855,363 @@ var ReplSession = class ReplSession {
 		context.setProp(context.global, "tools", toolsNs);
 		toolsNs.dispose();
 	}
+	/**
+	* Install the `task` global on the QuickJS context.
+	*
+	* Registers the host function directly as `globalThis.task`,
+	* then freezes it via `evalCode`. Structured results (when
+	* responseSchema is provided) are marshaled into native QuickJS
+	* objects on the host side — no JS wrapper needed.
+	*/
+	/**
+	* Replace the active bridge dispatch with a fresh one.
+	*
+	* Call this before each eval so the dispatch closure carries
+	* the current invocation's config (tracing callbacks, run ID, etc.)
+	* rather than the stale config from session creation.
+	*/
+	updateBridgeDispatch(dispatch) {
+		if (this.bridgeDispatchRef) this.bridgeDispatchRef.current = dispatch;
+	}
+	injectSubagentBridge(dispatch) {
+		const context = this.context;
+		const queue = this.subagentQueue;
+		this.bridgeDispatchRef = { current: dispatch };
+		const ref = this.bridgeDispatchRef;
+		const hostFn = context.newFunction("task", (inputHandle) => {
+			const input = context.dump(inputHandle);
+			const promise = context.newPromise();
+			(async () => {
+				try {
+					if (input == null || typeof input !== "object" || Array.isArray(input)) throw new Error("task: expected an object argument");
+					const obj = { ...input };
+					if ("subagent_type" in obj) {
+						obj.subagentType ??= obj.subagent_type;
+						delete obj.subagent_type;
+					}
+					if ("response_schema" in obj) {
+						obj.responseSchema ??= obj.response_schema;
+						delete obj.response_schema;
+					}
+					const unknownKeys = Object.keys(obj).filter((k) => !ReplSession.SUBAGENT_ALLOWED_KEYS.has(k));
+					if (unknownKeys.length > 0) throw new Error(`task: unknown keys: ${unknownKeys.join(", ")}. Allowed: ${[...ReplSession.SUBAGENT_ALLOWED_KEYS].join(", ")}`);
+					const { description, subagentType, responseSchema } = obj;
+					if (typeof description !== "string" || description.length === 0) throw new Error("task: 'description' is required and must be a non-empty string");
+					if (typeof subagentType !== "string" || subagentType.length === 0) throw new Error("task: 'subagentType' is required and must be a non-empty string");
+					if (responseSchema !== void 0 && (responseSchema == null || typeof responseSchema !== "object" || Array.isArray(responseSchema))) throw new Error("task: 'responseSchema' must be a plain object (JSON Schema) when provided");
+					const result = await queue.add(() => ref.current({
+						description,
+						subagentType,
+						...responseSchema !== void 0 && { responseSchema }
+					}));
+					if (typeof result === "string") {
+						const val = context.newString(result);
+						promise.resolve(val);
+						val.dispose();
+					} else {
+						const jsonResult = context.evalCode(`(${JSON.stringify(result)})`);
+						if (jsonResult.error) {
+							const errDump = context.dump(jsonResult.error);
+							jsonResult.error.dispose();
+							throw new Error(`task: failed to marshal structured response: ${JSON.stringify(errDump)}`);
+						}
+						promise.resolve(jsonResult.value);
+						jsonResult.value.dispose();
+					}
+				} catch (e) {
+					const msg = e != null && typeof e.message === "string" ? e.message : String(e);
+					const err = context.newError(msg);
+					promise.reject(err);
+					err.dispose();
+				}
+				promise.settled.then(context.runtime.executePendingJobs);
+			})();
+			return promise.handle;
+		});
+		context.setProp(context.global, "task", hostFn);
+		hostFn.dispose();
+		context.evalCode("Object.freeze(globalThis.task);Object.defineProperty(globalThis, 'task', { value: globalThis.task, writable: false, configurable: false,}); undefined");
+	}
 };
 //#endregion
+//#region src/subagent-dispatch.ts
+const SCHEMA_MAX_BYTES = 4096;
+const SCHEMA_MAX_DEPTH = 5;
+const SCHEMA_MAX_PROPERTIES = 32;
+/**
+* Validate that a response schema does not exceed size, depth, or
+* property-count limits.
+*
+* @throws Error if any limit is exceeded.
+*/
+function validateResponseSchema(schema) {
+	const serialized = JSON.stringify(schema);
+	if (serialized.length > SCHEMA_MAX_BYTES) throw new Error(`responseSchema exceeds ${SCHEMA_MAX_BYTES} byte limit (${serialized.length} bytes)`);
+	function check(node, depth, propCount) {
+		if (depth > SCHEMA_MAX_DEPTH) throw new Error(`responseSchema exceeds maximum nesting depth of ${SCHEMA_MAX_DEPTH}`);
+		const props = node.properties;
+		if (props != null && typeof props === "object" && !Array.isArray(props)) {
+			const propObj = props;
+			propCount.value += Object.keys(propObj).length;
+			if (propCount.value > SCHEMA_MAX_PROPERTIES) throw new Error(`responseSchema exceeds maximum of ${SCHEMA_MAX_PROPERTIES} properties`);
+			for (const value of Object.values(propObj)) if (value != null && typeof value === "object" && !Array.isArray(value)) check(value, depth + 1, propCount);
+		}
+		const items = node.items;
+		if (items != null && typeof items === "object" && !Array.isArray(items)) check(items, depth + 1, propCount);
+	}
+	check(schema, 0, { value: 0 });
+}
+//#endregion
 //#region src/middleware.ts
 /**
-* QuickJS REPL middleware for deepagents.
+* Code Interpreter middleware for deepagents.
 *
-* Provides a `js_eval` tool that runs JavaScript in a WASM-sandboxed QuickJS
+* Provides an `eval` tool that runs JavaScript in a WASM-sandboxed QuickJS
 * interpreter. Supports:
 * - Persistent state across evaluations (true REPL)
-* - VFS integration via readFile/writeFile
-* - Programmatic tool calling (PTC)
+* - Programmatic tool calling (PTC) — expose agent or custom tools inside the REPL
 */
+const DEFAULT_TOOL_NAME = "eval";
 /**
-* Backend-provided tools excluded from PTC by default.
-* These are redundant inside the REPL since VFS helpers (readFile/writeFile)
-* already cover file I/O against the agent's in-memory working set.
+* Render the subagent dispatch prompt section for the system message.
+* Ported from the Python `_SUBAGENT_SYSTEM_PROMPT_TEMPLATE`.
 */
-const DEFAULT_PTC_EXCLUDED_TOOLS = [
-	"ls",
-	"read_file",
-	"write_file",
-	"edit_file",
-	"glob",
-	"grep",
-	"execute"
-];
-const REPL_SYSTEM_PROMPT = dedent.default`
-  ## TypeScript/JavaScript REPL (\`js_eval\`)
-
-  You have access to a sandboxed TypeScript/JavaScript REPL running in an isolated interpreter.
-  TypeScript syntax (type annotations, interfaces, generics, \`as\` casts) is supported and stripped at evaluation time.
-  Variables, functions, and closures persist across calls within the same session.
-
-  ### Hard rules
-
-  - **No network, no filesystem** — only the helpers below. Do not attempt \`fetch\`, \`require\`, or \`import\`.
-  - **Cite your sources** — when reporting values from files, include the path and key/index so the user can verify.
-  - **Use console.log()** for output — it is captured and returned. \`console.warn()\` and \`console.error()\` are also available.
-  - **Reuse state from previous cells** — variables, functions, and results from earlier \`js_eval\` calls persist across calls. Reference them by name in follow-up cells instead of re-embedding data as inline JSON literals.
-
-  ### First-time usage
-
-  \`\`\`typescript
-  // Read a file from the agent's virtual filesystem
-  const raw: string = await readFile("/data.json");
-  const data = JSON.parse(raw) as { n: number };
-  console.log(data);
-
-  // Write results back
-  await writeFile("/output.txt", JSON.stringify({ result: data.n }));
-  \`\`\`
-
-  ### API Reference — built-in globals
-
-  \`\`\`typescript
-  /**
-   * Read a file from the agent's virtual filesystem. Throws if the file does not exist.
-   */
-  async readFile(path: string): Promise<string>
-
-  /**
-   * Write a file to the agent's virtual filesystem.
-   */
-  async writeFile(path: string, content: string): Promise<void>
-  \`\`\`
-
-  ### Limitations
-
-  - ES2023+ syntax with TypeScript support. No Node.js APIs, no \`require\`, no \`import\`.
-  - Output is truncated beyond a fixed character limit — be selective about what you log.
-  - Execution timeout per call (default 30 s).
-`;
+function renderSubagentPrompt(toolName) {
+	return dedent.default`
+
+    ### Dispatching Subagents with \`task\`
+
+    \`task\` is your primitive for running configured subagents from inside the
+    JavaScript REPL. Your job here is to DISTRIBUTE work, not to do it yourself:
+    write JavaScript that fans work out to subagents and assembles their results.
+    You handle the orchestration - fan-out, filtering, deduplication, multi-stage
+    flow, and synthesis - in plain JavaScript.
+
+    #### The primitive
+
+    \`\`\`javascript
+    await task({
+      description,      // full autonomous task prompt
+      subagentType,     // configured subagent name
+      responseSchema,   // optional JSON Schema for structured output
+    }); // -> Promise<unknown>
+    \`\`\`
+
+    \`task\` runs a full agentic loop for the selected configured subagent. The
+    subagent can use whatever tools it was configured with, iterate, inspect
+    context, and return one final result. \`subagentType\` is required; use one of
+    the configured subagent names.
+
+    \`description\` is the only prompt the subagent receives for this dispatch. Make
+    it complete: the goal, the constraints, what to inspect, and the exact shape
+    or level of detail you expect back. Give context as locators — file paths and
+    symbol names — not as pasted file contents. If you already read a file while
+    exploring, still pass its path and let the subagent read it; do not paste back
+    what you read. Each dispatch is stateless from the caller's perspective; you
+    cannot send follow-up messages to the same subagent run.
+
+    \`responseSchema\` is optional, but set it on any dispatch whose result feeds
+    later code. A deterministic, typed shape is what lets you compose the next
+    stage reliably — index it, sort it, compare fields, branch on it, merge it —
+    instead of parsing free-form text. This is what makes a whole workflow
+    composable as one script. When provided, the resolved value is already a typed
+    JavaScript value matching the schema; do not call \`JSON.parse\` unless the
+    subagent intentionally returned a JSON string. Dynamic schemas work for
+    declarative subagents; runnable-backed subagents reject dynamic schemas because
+    their runnable is already compiled.
+
+    #### Approval model
+
+    \`task\` dispatches from inside the already-running \`${toolName}\` call. It
+    does not route through the parent agent's \`ToolNode\`-managed \`task\` tool and
+    does not trigger parent-level \`interrupt_on\` / HITL approval for each dispatch.
+    Declarative subagents still honor approval middleware configured inside their
+    own spec. If you need approval before launching a subagent from the parent, use
+    the normal \`task\` tool outside JavaScript or ensure the \`${toolName}\` call
+    itself is approval-gated.
+
+    #### Mental model
+
+    Hold your work in JS: an array of items in, an array of results out. Merge each
+    dispatch result back onto its item. Multi-stage analysis means: run a pass,
+    filter or regroup the array in JS, then run another pass over the survivors.
+
+    You can run the whole workflow in one \`${toolName}\` call or split it across
+    several — both are fine. A single end-to-end script (generate, compare, pick a
+    winner; or review every item, then synthesize) is clean when you can write it
+    in one go; splitting is also fine when you want to inspect results between
+    stages. Either way, don't redo work across calls — reuse what is already in
+    scope (see "Reuse what earlier evals left in scope" below).
+
+    #### Fan out with bounded concurrency
+
+    Dispatch independent work in parallel with \`Promise.all\`, but in explicit
+    batches around 10 so you do not launch hundreds of subagents at once. The bridge
+    enforces a hard per-REPL cap of 32 concurrent subagent calls.
+
+    \`\`\`javascript
+    const files = ["/src/a.ts", "/src/b.ts", "/src/c.ts"]; // found while exploring
+    const batchSize = 10;
+    const reviewed = [];
+    for (let i = 0; i < files.length; i += batchSize) {
+      const batch = files.slice(i, i + batchSize);
+      reviewed.push(...(await Promise.all(batch.map(async (file) => {
+        const result = await task({
+          description: "Read " + file + " and review it for SQL injection. " +
+            "Cite line numbers.",
+          subagentType: "reviewer",
+          responseSchema: {
+            type: "object",
+            properties: {
+              vulnerabilities: {
+                type: "array",
+                items: {
+                  type: "object",
+                  properties: {
+                    type: { type: "string" },
+                    line: { type: "number" },
+                    evidence: { type: "string" },
+                  },
+                  required: ["type", "line", "evidence"],
+                },
+              },
+            },
+            required: ["vulnerabilities"],
+          },
+        });
+        return { file, ...result };
+      }))));
+    }
+    \`\`\`
+
+    #### Explore with your own tools first, then distribute
+
+    You already have your normal tools for reading, listing, globbing, and
+    grepping files. Use them to explore and understand the task BEFORE you write
+    the orchestration script. These are ordinary tool calls, separate from the
+    \`${toolName}\` tool: read the data file, list or glob the directory, grep for
+    what matters, then decide how to split the work.
+
+    Never write \`${toolName}\` code that spawns a subagent just to read or parse a
+    file or list a directory. That is a deterministic step you do yourself with a
+    direct tool call; spending a whole agent loop on it is wasteful.
+
+    Once you understand the shape of the work, you have creative freedom in how
+    you split it:
+
+    - One dispatch per file or per record, when the items are already separate.
+    - Chunk a large input yourself — read it, split it, optionally write a small
+      input file per chunk — and dispatch one subagent per chunk.
+    - A cheap classification pass first, then deeper dispatches only for the items
+      that warrant them.
+
+    Then write JavaScript in the \`${toolName}\` tool that distributes the heavy,
+    agentic work to subagents with \`task()\`: analyzing file contents, exploring a
+    codebase, making judgment calls, rewriting code, or synthesizing a report.
+
+    Hand each subagent a locator, not a payload. Subagents have their own file
+    tools, so for anything that lives in a file — a file to review, rewrite, or
+    audit — pass the path and let the subagent read it. Do NOT read a whole file
+    just to paste its contents into the description; that bloats every dispatch
+    and duplicates the file across them. Reserve inline content for small or
+    derived data that has no path of its own: a single parsed record, or a chunk
+    you split out of a larger input (write the chunk to its own file and pass that
+    path if it is large). Assemble the results in JS.
+
+    #### Compose multiple stages
+
+    Filter the array in JS between passes. For example: first ask subagents for a
+    cheap classification, filter to the risky items, then dispatch deeper reviews
+    only for those items.
+
+    \`\`\`javascript
+    const tagged = await Promise.all(files.map((file) =>
+      task({
+        description: "Read " + file + " and classify it as handler, util, " +
+          "test, or config.",
+        subagentType: "reviewer",
+        responseSchema: {
+          type: "object",
+          properties: { kind: { type: "string" }, risky: { type: "boolean" } },
+          required: ["kind", "risky"],
+        },
+      }).then((tag) => ({ file, ...tag }))
+    ));
+
+    const riskyHandlers = tagged.filter((it) => it.kind === "handler" && it.risky);
+    const deepReviews = await Promise.all(riskyHandlers.map((it) =>
+      task({
+        description: "Deep security review of " + it.file + ". Cite line numbers.",
+        subagentType: "reviewer",
+      }).then((review) => ({ ...it, review }))
+    ));
+    \`\`\`
+
+    #### Return results via the last expression, not \`console.log\`
+
+    The value of the last expression in an \`${toolName}\` call (or a resolved
+    top-level \`await\`) is returned to you as the result. Make that final
+    expression the variable holding your result and read it from there.
+    \`console.log\` is only for incidental debugging: its output is capped and
+    truncated, while the returned value is not, so never \`console.log\` your
+    actual results.
+
+    Keep large intermediate sets in JS variables and return only a compact
+    summary or a small slice, not the entire dataset. To persist full output,
+    have a subagent write it, or write it with your own file tool outside the
+    \`${toolName}\` call.
+
+    #### Reuse what earlier evals left in scope
+
+    The REPL is persistent within a turn: every top-level variable, function, and
+    class you declare is kept and is available in your next \`${toolName}\` call
+    (each is hoisted to global scope). So if a later step needs something an
+    earlier eval produced or bound, **reference that variable by name** — do not
+    write a new literal that re-types data a previous eval already returned or
+    computed.
+
+    If you catch yourself pasting a big array or object of values you produced in
+    an earlier call, that is the tell: the variable is still in scope, so use it.
+    Re-typing prior results as a fresh literal wastes tokens and drifts from what
+    actually ran.
+
+    \`\`\`javascript
+    // An earlier eval bound this:
+    //   const auditResults = await Promise.all(files.map(/* ...audit... */));
+
+    // A later eval — reference it; do NOT paste the findings back in as a literal:
+    const findings = auditResults.flatMap((r) =>
+      r.findings.map((f) => ({ ...f, file: r.file }))
+    );
+    const verified = await Promise.all(findings.map((f) =>
+      task({ description: "Verify this finding: " + f.evidence, subagentType: "verifier" })
+        .then((v) => ({ ...f, ...v }))
+    ));
+    \`\`\`
+
+    #### When the user asks for a "workflow"
+
+    If the user's request mentions running a "workflow" (or otherwise uses the
+    word "workflow"), fan the work out to subagents rather than doing it all
+    yourself. Explore with your own tools first as needed, then write JavaScript
+    in the \`${toolName}\` tool that dispatches subagents with \`task()\` and
+    assembles their results. The point is to distribute the heavy work in
+    parallel, not to grind through it one tool call at a time.
+  `;
+}
+function renderReplSystemPrompt(opts) {
+	const sideEffects = opts.hasPtc ? " External side effects from inside the REPL are reachable only via the `tools.*` namespace documented below." : " The REPL is pure computation; do any filesystem or other I/O with your normal tools, outside this tool.";
+	return dedent.default`
+    ### Interpreter
+
+    An \`${opts.toolName}\` tool is available. It runs JavaScript in a persistent REPL.
+    - State (variables, functions) persists across tool calls within a single turn of conversation. They DO NOT persist across multiple turns.
+    - Top-level \`await\` works; Promises resolve before the call returns.
+    - Runtime sandbox: no built-in filesystem, network, stdlib, or wall-clock APIs (\`fetch\`, \`require\`, \`fs\`, \`process\`, real \`Date.now()\` are unavailable or stubbed).${sideEffects}
+    - Timeout: ${opts.timeout}s per call. Memory: ${opts.memoryLimitMb} MB total.
+    - \`console.log\` output is captured and returned alongside the result.
+  `;
+}
 /**
 * Generate the PTC API Reference section for the system prompt.
 */
@@ -703,89 +1248,133 @@ async function generatePtcPrompt(tools) {
   `;
 }
 /**
-* Resolve backend from factory or instance.
+* Resolves a mixed list of tool names and tool instances into a flat list of
+* StructuredToolInterface objects. Strings are looked up by name in agentTools;
+* instances are included directly without requiring agent registration. Strings
+* that don't match any agent tool are silently omitted.
+*
+* Throws if the subagent `task` tool is requested (by name or instance): it is
+* reserved for the `task()` global and cannot be a `tools.*` PTC member.
 */
-function getBackend(backend, stateAndStore) {
-	if (typeof backend === "function") return backend(stateAndStore);
-	return backend;
+function resolveToolList(items, agentTools) {
+	const agentByName = new Map(agentTools.map((t) => [t.name, t]));
+	return items.flatMap((item) => {
+		if ((typeof item === "string" ? item : item.name) === "task") throw new Error("The subagent `task` tool cannot be exposed via `ptc`. It is always available as the top-level `task()` global inside the REPL (with `subagentType` and `responseSchema` support); exposing it through the `tools.*` namespace would create a second, conflicting dispatch path that drops `responseSchema`. Remove \"task\" from `ptc`.");
+		if (typeof item === "string") {
+			const found = agentByName.get(item);
+			return found ? [found] : [];
+		}
+		return [item];
+	});
 }
 /**
-* Create the QuickJS REPL middleware.
+* Create the Code Interpreter middleware.
 */
-function createQuickJSMiddleware(options = {}) {
-	const { backend = (stateAndStore) => new deepagents.StateBackend(stateAndStore), ptc = false, memoryLimitBytes = DEFAULT_MEMORY_LIMIT, maxStackSizeBytes = DEFAULT_MAX_STACK_SIZE, executionTimeoutMs = DEFAULT_EXECUTION_TIMEOUT, systemPrompt: customSystemPrompt = null } = options;
-	const usePtc = ptc !== false;
-	const baseSystemPrompt = customSystemPrompt || REPL_SYSTEM_PROMPT;
+function createCodeInterpreterMiddleware(options = {}) {
+	const { ptc, memoryLimitBytes = DEFAULT_MEMORY_LIMIT, maxStackSizeBytes = DEFAULT_MAX_STACK_SIZE, executionTimeoutMs = DEFAULT_EXECUTION_TIMEOUT, systemPrompt: customSystemPrompt = null, maxPtcCalls = 256, maxResultChars = DEFAULT_MAX_RESULTS_CHARS, toolName = DEFAULT_TOOL_NAME, captureConsole = true, subagents = true } = options;
+	const maxSubagentConcurrency = subagents ? 32 : 0;
+	if (maxPtcCalls !== null && maxPtcCalls !== void 0 && maxPtcCalls < 1) throw new Error("`maxPtcCalls` must be >= 1 or null");
+	const middlewareId = crypto.randomUUID();
 	let cachedPtcPrompt = null;
 	let ptcTools = [];
+	let taskTool = null;
 	function filterToolsForPtc(allTools) {
-		if (ptc === false) return [];
-		const candidates = allTools.filter((t) => t.name !== "js_eval");
-		if (ptc === true) {
-			const excluded = new Set(DEFAULT_PTC_EXCLUDED_TOOLS);
-			return candidates.filter((t) => !excluded.has(t.name));
-		}
-		if (Array.isArray(ptc)) {
-			const included = new Set(ptc);
-			return candidates.filter((t) => included.has(t.name));
-		}
-		if ("include" in ptc) {
-			const included = new Set(ptc.include);
-			return candidates.filter((t) => included.has(t.name));
-		}
-		if ("exclude" in ptc) {
-			const excluded = new Set([...DEFAULT_PTC_EXCLUDED_TOOLS, ...ptc.exclude]);
-			return candidates.filter((t) => !excluded.has(t.name));
-		}
-		return [];
+		if (!ptc) return [];
+		const candidates = allTools.filter((t) => t.name !== toolName);
+		return resolveToolList(ptc, candidates);
+	}
+	function findTaskTool(tools) {
+		return tools.find((t) => t.name === "task") ?? null;
+	}
+	function createBridgeDispatch(subagentTaskTool, config) {
+		return async (input) => {
+			const hasSchema = input.responseSchema != null;
+			if (hasSchema) validateResponseSchema(input.responseSchema);
+			const toolConfig = {
+				...config,
+				configurable: {
+					...config.configurable,
+					...hasSchema && { [deepagents.SUBAGENT_RESPONSE_FORMAT_CONFIG_KEY]: input.responseSchema }
+				}
+			};
+			const content = unwrapToolEnvelope(await subagentTaskTool.invoke({
+				description: input.description,
+				subagent_type: input.subagentType
+			}, toolConfig));
+			if (hasSchema && typeof content === "string") try {
+				return JSON.parse(content);
+			} catch {
+				return content;
+			}
+			return content;
+		};
 	}
 	return (0, langchain.createMiddleware)({
-		name: "QuickJSMiddleware",
+		name: "CodeInterpreterMiddleware",
 		tools: [(0, langchain.tool)(async (input, config) => {
 			const threadId = config.configurable?.thread_id || "__default__";
-			const resolvedBackend = getBackend(backend, {
-				state: (0, _langchain_langgraph.getCurrentTaskInput)(config) || {},
-				store: config.store
-			});
-			const session = ReplSession.getOrCreate(threadId, {
+			const sessionKey = `${threadId}:${middlewareId}`;
+			const session = ReplSession.getOrCreate(sessionKey, {
 				memoryLimitBytes,
 				maxStackSizeBytes,
-				backend: resolvedBackend,
-				tools: ptcTools
+				maxPtcCalls,
+				tools: ptcTools,
+				maxResultChars,
+				captureConsole,
+				sessionId: threadId,
+				subagentBridge: taskTool && maxSubagentConcurrency > 0 ? {
+					dispatch: createBridgeDispatch(taskTool, config),
+					maxConcurrency: maxSubagentConcurrency
+				} : void 0
 			});
-			const result = await session.eval(input.code, executionTimeoutMs);
-			await session.flushWrites(resolvedBackend);
-			return formatReplResult(result);
+			if (taskTool && maxSubagentConcurrency > 0) session.updateBridgeDispatch(createBridgeDispatch(taskTool, config));
+			return formatReplResult(await session.eval(input.code, executionTimeoutMs));
 		}, {
-			name: "js_eval",
+			name: toolName,
 			description: dedent.default`
         Evaluate TypeScript/JavaScript code in a sandboxed REPL. State persists across calls.
-        Use readFile(path) and writeFile(path, content) for file access.
         Use console.log() for output. Returns the result of the last expression.
+        If file or other tools are available, call them via the tools namespace: await tools.readFile({ path }).
       `,
+			metadata: { ls_code_input_language: "javascript" },
 			schema: zod_v4.z.object({ code: zod_v4.z.string().describe("TypeScript/JavaScript code to evaluate in the sandboxed REPL") })
 		})],
 		wrapModelCall: async (request, handler) => {
 			const agentTools = request.tools || [];
-			ptcTools = usePtc ? filterToolsForPtc(agentTools) : [];
+			ptcTools = filterToolsForPtc(agentTools);
+			if (!taskTool && maxSubagentConcurrency > 0) taskTool = findTaskTool(agentTools);
 			if (ptcTools.length > 0 && !cachedPtcPrompt) cachedPtcPrompt = await generatePtcPrompt(ptcTools);
-			const systemMessage = request.systemMessage.concat(baseSystemPrompt).concat(cachedPtcPrompt || "");
+			const baseSystemPrompt = customSystemPrompt || renderReplSystemPrompt({
+				toolName,
+				timeout: executionTimeoutMs / 1e3,
+				memoryLimitMb: Math.floor(memoryLimitBytes / (1024 * 1024)),
+				hasPtc: ptcTools.length > 0
+			});
+			const subagentPrompt = taskTool && maxSubagentConcurrency > 0 ? renderSubagentPrompt(toolName) : "";
+			const systemMessage = request.systemMessage.concat(baseSystemPrompt).concat(subagentPrompt).concat(cachedPtcPrompt || "");
 			return handler({
 				...request,
 				systemMessage
 			});
+		},
+		afterAgent: async (_state, runtime) => {
+			const sessionKey = `${runtime.configurable?.thread_id ?? "__default__"}:${middlewareId}`;
+			ReplSession.deleteSession(sessionKey);
 		}
 	});
 }
 //#endregion
 exports.DEFAULT_EXECUTION_TIMEOUT = DEFAULT_EXECUTION_TIMEOUT;
+exports.DEFAULT_MAX_PTC_CALLS = DEFAULT_MAX_PTC_CALLS;
 exports.DEFAULT_MAX_STACK_SIZE = DEFAULT_MAX_STACK_SIZE;
 exports.DEFAULT_MEMORY_LIMIT = DEFAULT_MEMORY_LIMIT;
-exports.DEFAULT_PTC_EXCLUDED_TOOLS = DEFAULT_PTC_EXCLUDED_TOOLS;
+exports.PTCCallBudgetExceededError = PTCCallBudgetExceededError;
 exports.ReplSession = ReplSession;
-exports.createQuickJSMiddleware = createQuickJSMiddleware;
+exports.createCodeInterpreterMiddleware = createCodeInterpreterMiddleware;
 exports.formatReplResult = formatReplResult;
+exports.stripTypeSyntax = stripTypeSyntax;
 exports.toCamelCase = toCamelCase;
 exports.transformForEval = transformForEval;
+exports.validateResponseSchema = validateResponseSchema;
 
 //# sourceMappingURL=index.cjs.map