@llblab/pi-telegram 0.35.2 → 0.36.1

package/docs/outbound.md

@@ -164,11 +164,11 @@ I can continue.
 
 Rules:
 
-- `telegram_button` accepts a JSON object, JSON matrix, [Compact Matrix Literal](./compact-matrix-literal.md), or double-quoted HTML-like attributes; `telegram_buttons` is an exact plural alias. CML uses `{value}` or `{label|prompt}`, trims both atoms, preserves non-structural printable text, and decodes only `\|`, `\}`, and `\\`. Shorthand, body, paired-comment, unquoted-attribute, and single-quoted-attribute forms are rejected.
+- `telegram_button` accepts a JSON object, adaptive JSON/CML matrix, positional [Compact Matrix Literal](./compact-matrix-literal.md), or double-quoted HTML-like attributes; `telegram_buttons` is an exact plural alias. Named JSON objects and positional cells may coexist in one matrix or row, and commas are optional only between completed elements while JSON object internals remain strict. CML uses `{value}`, `{label|prompt}`, or `{label|prompt|selected_style}`; the optional third atom requires a prompt and accepts only `primary`, `success`, or `danger`. It trims every atom, preserves non-structural printable text, and decodes only `\|`, `\}`, and `\\`. Shorthand, body, paired-comment, unquoted-attribute, and single-quoted-attribute forms are rejected.
 - A colon after either button marker is rejected so every payload form shares one unambiguous action marker.
 - Use `label` plus `prompt`, or the compact `value` key when both strings are identical. Explicit `label` or `prompt` takes precedence over its `value` fallback. Use JSON with `\n` escapes for multiline prompts.
 - The opening marker must start at column zero on a top-level line outside fenced code, quotes, lists, and indented examples; otherwise it remains literal Markdown.
-- Prefer one matrix comment for multiple buttons. Each top-level JSON object or CML cell becomes one full-width inline-keyboard row in source order; a nested row groups one or more buttons horizontally. The parser imposes no artificial per-row width cap; empty rows, malformed cells, unknown/trailing CML escapes, a second unescaped CML separator, and deeper nesting are rejected atomically. Generated surfaces default to five columns and expand to six through eight only for short position-bearing labels. Repeated singular comments remain valid.
+- Prefer one matrix comment for multiple buttons. Each top-level JSON object or CML cell becomes one full-width inline-keyboard row in source order; a nested row groups one or more buttons horizontally. The parser imposes no artificial per-row width cap; empty rows, malformed cells, unknown/trailing CML escapes, a third unescaped CML separator, empty atoms, unknown selected styles, and deeper nesting are rejected atomically. Generated surfaces default to five columns and expand to six through eight only for short position-bearing labels. Repeated singular comments remain valid.
 - Button actions are stored in memory with short `callback_data`; Telegram never sees the full prompt in the button payload.
 - After Telegram accepts a generated button callback as a queued prompt, the bridge changes that exact button to its configured selection style without changing agent-authored text or emoji. Set `selected_style` to `primary` (blue), `success` (green), or `danger` (red); omitted or invalid values fall back to `primary`. The style never suppresses queue admission. Other choices stay visually unchanged and remain available; the callback acknowledgement remains the fallback on clients that do not render button styles.
 - When generated button markup is the entire assistant reply, the bridge supplies the standard `☑️ **Choose an option:**` heading as visible message text so Telegram has a message to which it can attach the inline keyboard.

package/docs/public-api.md

@@ -61,11 +61,12 @@ This command surface is a mobile companion subset, not a raw terminal-command br
 
 ### Tools and assistant-authored actions
 
+- `telegram_bind({ app, script, argument? } | { app, method, argument? })` installs and initializes one canonical managed Generative App module under `<agent-dir>/genapps/<app>/<app>.mjs`, or invokes one named method on an installed app. Installation rejects silent replacement and noncanonical/symlink sources. Methods receive immutable JSON state, one optional JSON argument, cancellation, revision, and a bounded non-shell process port; successful state changes commit to `state.json` plus `states.jsonl`, while output-only methods leave history unchanged. After one-shot `tgbtn` resolution, a complete `app::method` or `app::method(<strict JSON>)` prompt invokes the installed app before Pi queue admission and sends its planned Markdown/buttons directly; malformed or failed bound actions never fall back to a model prompt. Direct app-output buttons retain hidden source revisions and stale actions fail before method execution; sibling processes serialize transitions and recover dead lock owners. Bound actions send a fresh message by default and retain the clicked button's selected state on its prior surface. A result may opt into `viewMode: "edit"` to replace the callback message and keyboard in place, with one fresh-send fallback only for that explicit action. Agent-mediated initial-surface revisions, process-birth lock proof, automatic refresh, and voice output remain open.
 - `telegram_attach(paths, chat_id?, thread_id?, caption?)` is the stable artifact delivery tool for generated files. During Telegram turns it queues files for the active reply; with `assistant.rendering: "rich"`, exactly one PNG/JPEG, MP4, or MP3 artifact plus non-empty final Markdown can become one reply-anchored Rich Message. HTML mode, multiple/unsupported files, Guest Mode, and voice outputs retain their established paths. Outside Telegram turns the tool sends files directly to the paired/default chat, the registered follower's assigned thread, or an explicit `chat_id` plus optional `thread_id` when this Pi instance owns `/telegram-connect` or is registered with the multi-instance bus.
 - `telegram_message(text, chat_id?, thread_id?)` sends a direct Telegram Markdown message when this Pi instance owns `/telegram-connect` or is registered with the multi-instance bus. During an active Telegram turn, omitted targeting and an explicit target equal to that turn are rejected so the ordinary final-reply path remains the sole current-target response; an explicit different chat/thread target remains allowed for requested cross-target delivery. Outside active turns, paired/default local/TUI delivery remains unchanged. Top-level `telegram_button` comments inside `text` are parsed with the same planner used for normal replies and attached to that message; buttons are never standalone Telegram messages.
-- The bundled `telegram-bridge` Skill owns action syntax, target routing, Threaded Mode, formatting, and profile-specific debugging guidance. The regular prompt routes applicable turns to that Skill. `telegram_attach` and `telegram_message` remain registered but are model-active only while this instance owns direct transport or holds a live follower registration; disconnect/loss suppresses their schemas and prompt metadata, and recovery restores only the operator's previously active pi-telegram subset.
+- The bundled `telegram-bridge` Skill owns action syntax, target routing, Threaded Mode, formatting, Generative App operation, and profile-specific debugging guidance. The regular prompt routes applicable turns to that Skill. `telegram_attach`, `telegram_bind`, and `telegram_message` remain registered but are model-active only while this instance owns direct transport or holds a live follower registration; disconnect/loss suppresses their schemas and prompt metadata, and recovery restores only the operator's previously active pi-telegram subset.
 - `telegram_voice` hidden comments request Telegram-native voice delivery through either a JSON object or double-quoted attributes. Equivalent `text` or `value` supplies the spoken payload; explicit `text` takes precedence.
-- `telegram_button` hidden comments create inline buttons whose taps enqueue prompts. One marker accepts a JSON object, JSON matrix, [Compact Matrix Literal](./compact-matrix-literal.md), or double-quoted attributes; `telegram_buttons` is an exact plural alias. Top-level matrix cells become full-width rows, while nested rows group one or more buttons horizontally without an artificial parser-width cap. CML uses `{value}` or `{label|prompt}`, trims atom boundaries, and supports only the minimal escapes `\|`, `\}`, and `\\`. Prefer one matrix comment for multiple buttons. Use JSON `label` plus `prompt`, or `value` when both strings are identical. Action markers are colon-free; colon-prefixed payloads are rejected. Use top-level column-zero comments outside code, quotes, lists, and indented examples; do not emit standalone button actions.
+- `telegram_button` hidden comments create inline buttons whose taps enqueue prompts. One marker accepts a JSON object, adaptive JSON/CML matrix, positional [Compact Matrix Literal](./compact-matrix-literal.md), or double-quoted attributes; `telegram_buttons` is an exact plural alias. Named JSON objects and positional cells may coexist in one matrix or row, and commas are optional only between completed elements. Top-level cells become full-width rows, while nested rows group one or more buttons horizontally without an artificial parser-width cap. CML uses `{value}`, `{label|prompt}`, or `{label|prompt|selected_style}`; the optional third atom requires a prompt and accepts only `primary`, `success`, or `danger`. It trims atom boundaries and supports only the minimal escapes `\|`, `\}`, and `\\`. Prefer one matrix comment for multiple buttons. Use JSON `label` plus `prompt`, or `value` when both strings are identical. Action markers are colon-free; colon-prefixed payloads are rejected. Use top-level column-zero comments outside code, quotes, lists, and indented examples; do not emit standalone button actions.
 
 Prompt guidance is context-aware: local/TUI prompts see only explicit direct-delivery guidance, while Telegram-originated turns receive the full action-comment syntax and phone-width output contract.
 

package/docs/ui-style.md

@@ -54,7 +54,7 @@ Use emoji as stable semantic markers, not decoration. Emoji carry transportable
 | `➡️` | Choose replacement target | Thread replace/restore target buttons that select which Pi instance should move to the current thread | Use inside the second replace/restore chooser, not for ordinary reroutes. |
 | `☑️` | Activate / choose this item | Model detail activation action, generated button-only choice heading | Positive selection cue; use `🟢 Active` for already-current state. |
 | `❌` | No / cancel | Confirmation cancel buttons | Use for safe cancellation, not destructive removal. |
-| `🗑` | Delete / suppress | Queue delete actions, destructive confirmations, suppression reaction | The explicit queue button deletes; the reaction reversibly suppresses a waiting turn. |
+| `🗑` | Delete / defer removal | Destructive confirmations and removal reaction | In the queue menu, reversible Keep/Skip selectors replace immediate deletion. |
 
 ### State Indicators And Button Grammars
 
@@ -62,13 +62,21 @@ Use emoji as stable semantic markers, not decoration. Emoji carry transportable
 | --- | --- | --- | --- |
 | `🟢` | Current/active/enabled `On` | Current option in vertical lists, active state rows, active `On` toggle | One strong current marker per option list. |
 | `🟡` | Active `Off` or elevated/filter state | Active `Off` toggle, Priority/Scoped active tab | Yellow means intentionally not-normal or off/default-caution, not error. |
+| `🔴` | Active destructive/deferred disposition | Active queue `Skip` selector | Red distinguishes a prompt that will be discarded at dispatch from reversible neutral or elevated state. |
 | `🟣` | Normal/default active tab | Normal priority tab, All/default scope tab, active page picker | Use for neutral active tabs. |
 | `⚫️` | Inactive placeholder | Inactive toggle values and inactive tabs | Keeps row width stable. |
 | `⬆️` | Navigate upward | `⬆️ Main menu`, `⬆️ Back` | Always first row in submenus. |
 
 ### Queue Reaction Shortcuts
 
-Queue reactions are shortcut controls for waiting turns. Preserve their semantics across Telegram reactions, queue-menu rows, status previews, and tests.
+Queue reactions are shortcut controls for waiting turns. Preserve their semantics across Telegram reactions, queue-menu rows, status previews, and tests. Positive emoji control the Priority/Normal lane; negative emoji control Keep/Skip. These categories are independent, may coexist, and mutate only their own dimension. Crossing lanes appends the prompt at the destination FIFO tail; changing Keep/Skip or changing emoji within one category preserves lane position. Skip wins only when dispatch reaches the prompt.
+
+Queue item detail renders two independent selector rows:
+
+- `🟡 Priority` / `⚫️ Normal` or `⚫️ Priority` / `🟣 Normal` selects the lane.
+- `🟢 Keep` / `⚫️ Skip` or `⚫️ Keep` / `🔴 Skip` selects dispatch disposition.
+
+The menu may clear internal Skip but cannot remove a reaction created by the user through Telegram's Bot API.
 
 | Emoji | Meaning | Canonical surfaces | Notes |
 | --- | --- | --- | --- |
@@ -77,11 +85,11 @@ Queue reactions are shortcut controls for waiting turns. Preserve their semantic
 | `❤` / `❤️` | Promote to priority | Queue reaction shortcut | Normalize display consistently where code normalizes reactions. |
 | `🕊` / `🕊️` | Promote to priority | Queue reaction shortcut | Soft/peaceful promotion gesture. |
 | `🔥` | Promote to priority | Queue reaction shortcut | Urgent/hot promotion gesture. |
-| `👎` | Suppress waiting turn | Queue reaction shortcut and suppressed queue badge | Suppression is reversible and is not negative feedback to the agent. |
-| `👻` | Suppress waiting turn | Queue reaction shortcut and suppressed queue badge | Disappear/suppress metaphor. |
-| `💔` | Suppress waiting turn | Queue reaction shortcut and suppressed queue badge | Reversible cancel metaphor. |
-| `💩` | Suppress waiting turn | Queue reaction shortcut and suppressed queue badge | Reversible reject metaphor. |
-| `🗑` | Suppress or explicitly delete | Queue reaction shortcut, suppressed queue badge, and queue delete UI | The reaction is reversible suppression; only the explicit queue button is destructive. |
+| `👎` | Defer removal of waiting turn | Queue reaction shortcut and queue emoji marker | Reversible until the marked turn reaches dispatch; not negative feedback to the agent. |
+| `👻` | Defer removal of waiting turn | Queue reaction shortcut and queue emoji marker | Disappear/remove metaphor. |
+| `💔` | Defer removal of waiting turn | Queue reaction shortcut and queue emoji marker | Reversible cancel metaphor. |
+| `💩` | Defer removal of waiting turn | Queue reaction shortcut and queue emoji marker | Reversible reject metaphor. |
+| `🗑` | Defer removal | Queue reaction shortcut and queue emoji marker | Like Skip, the reaction remains reversible until dispatch reaches the marked turn. |
 
 ### Decorative Or Local-Example Emoji
 

package/index.ts

@@ -228,6 +228,8 @@ export default function (pi: Pi.ExtensionAPI) {
   const proactivePushChatIdGetter =
     Config.createTelegramProactivePushChatIdGetter(proactivePushTargetGetter);
   const buttonActionStore = Outbound.createTelegramButtonActionStore();
+  const planGenerativeAppOutput =
+    Outbound.createTelegramOutboundReplyPlanner(buttonActionStore);
   const pendingModelSwitchStore =
     Model.createPendingModelSwitchStore<
       Model.ScopedTelegramModel<ActivePiModel>
@@ -502,6 +504,16 @@ export default function (pi: Pi.ExtensionAPI) {
       getHandlers: configStore.getOutboundHandlers,
       recordRuntimeEvent,
     });
+  const invokeGenerativeAppBoundButtonAction =
+    Bindings.createTelegramGenerativeAppBoundButtonActionInvoker({
+      agentDir: Paths.resolveAgentDir(),
+      assertExecutionCurrent: Updates.assertTelegramUpdateExecutionCurrent,
+      getExecutionFence: Updates.getTelegramUpdateExecutionFence,
+      planOutput: planGenerativeAppOutput,
+      sendMarkdownReply,
+      editInteractiveMessage,
+      recordRuntimeEvent,
+    });
   const {
     activityRuntime,
     activityVerbosityRuntime,
@@ -760,6 +772,7 @@ export default function (pi: Pi.ExtensionAPI) {
     settingsMenuCallbackHandler: settingsMenuRuntime.handleCallbackQuery,
     sectionRegistry,
     buttonActionStore,
+    invokeBoundButtonAction: invokeGenerativeAppBoundButtonAction,
     inboundHandlerRuntime,
     threadStore,
     updateStatus,
@@ -1219,6 +1232,7 @@ export default function (pi: Pi.ExtensionAPI) {
 
   Bindings.registerTelegramCommandsAndTools({
     pi,
+    agentDir: Paths.resolveAgentDir(),
     configStore,
     persistConfig: persistTelegramConfigWithSync,
     setup,

package/lib/bindings.ts

@@ -26,6 +26,7 @@ import * as Setup from "./setup.ts";
 import * as Status from "./status.ts";
 import * as TelegramApi from "./telegram-api.ts";
 import type { TelegramTarget } from "./target.ts";
+import * as GenerativeApps from "./generative-apps.ts";
 
 type ActivePiModel = NonNullable<Pi.ExtensionContext["model"]>;
 
@@ -53,10 +54,7 @@ export interface TelegramQueueBindingRuntime<TContext> {
 
 export function createTelegramQueueBindingRuntime<TContext>(deps: {
   store: Queue.TelegramQueueStateStore<TContext>;
-  queue: Pick<
-    Runtime.TelegramBridgeRuntime["queue"],
-    "getNextPriorityReactionOrder" | "incrementNextPriorityReactionOrder"
-  >;
+  queue: Pick<Runtime.TelegramBridgeRuntime["queue"], "allocateItemOrder">;
   lifecycle: Pick<
     Runtime.TelegramBridgeRuntime["lifecycle"],
     "isCompactionInProgress" | "hasDispatchPending"
@@ -95,9 +93,7 @@ export function createTelegramQueueBindingRuntime<TContext>(deps: {
 }): TelegramQueueBindingRuntime<TContext> {
   const mutation = Queue.createTelegramQueueMutationController({
     ...deps.store,
-    getNextPriorityReactionOrder: deps.queue.getNextPriorityReactionOrder,
-    incrementNextPriorityReactionOrder:
-      deps.queue.incrementNextPriorityReactionOrder,
+    allocateLaneOrder: deps.queue.allocateItemOrder,
     onItemsDiscarded(items, ctx) {
       deps.admission.getSettlement()?.onItemsDiscarded(items, ctx);
     },
@@ -146,6 +142,108 @@ export function createTelegramQueueBindingRuntime<TContext>(deps: {
   };
 }
 
+export function createTelegramGenerativeAppBoundButtonActionInvoker<
+  TQuery extends {
+    message?: { chat?: { id?: number }; message_id?: number };
+  },
+>(deps: {
+  agentDir: string;
+  assertExecutionCurrent: (query: TQuery) => void;
+  getExecutionFence: (query: TQuery) => GenerativeApps.GenerativeAppExecutionFence | undefined;
+  planOutput: ReturnType<typeof OutboundHandlers.createTelegramOutboundReplyPlanner>;
+  sendMarkdownReply: (
+    chatId: number,
+    replyToMessageId: number,
+    markdown: string,
+    options?: { replyMarkup?: OutboundHandlers.TelegramOutboundButtonMarkup },
+  ) => Promise<unknown>;
+  editInteractiveMessage?: (
+    chatId: number,
+    messageId: number,
+    markdown: string,
+    mode: "markdown",
+    replyMarkup: OutboundHandlers.TelegramOutboundButtonMarkup,
+  ) => Promise<void>;
+  recordRuntimeEvent: TelegramRuntimeEventRecorder;
+}): (
+  action: OutboundHandlers.TelegramOutboundButtonAction,
+  query: TQuery,
+) => Promise<false | "new" | "edit"> {
+  return async (action, query) => {
+    let boundAction: GenerativeApps.GenerativeAppBoundAction | undefined;
+    try {
+      boundAction = GenerativeApps.parseGenerativeAppBoundAction(action.prompt);
+      if (!boundAction) return false;
+      deps.assertExecutionCurrent(query);
+      const result = await GenerativeApps.invokeGenerativeApp({
+        agentDir: deps.agentDir,
+        ...(deps.getExecutionFence(query)
+          ? { execution: deps.getExecutionFence(query) }
+          : {}),
+        ...(boundAction.argument !== undefined
+          ? { argument: boundAction.argument }
+          : {}),
+        ...(action.binding?.app === boundAction.app
+          ? {
+              expectedGeneration: action.binding.generation,
+              expectedRevision: action.binding.revision,
+            }
+          : {}),
+        method: boundAction.method,
+        app: boundAction.app,
+      });
+      deps.assertExecutionCurrent(query);
+      const chatId = query.message?.chat?.id;
+      const messageId = query.message?.message_id;
+      if (typeof chatId !== "number" || typeof messageId !== "number") {
+        throw new Error("Generative App callback target is unavailable.");
+      }
+      const reply = deps.planOutput(result.output, {
+        binding: {
+          generation: result.generation,
+          app: result.app,
+          revision: result.revision,
+        },
+      });
+      if (result.viewMode === "edit" && deps.editInteractiveMessage) {
+        let editFailed = false;
+        try {
+          await deps.editInteractiveMessage(
+            chatId,
+            messageId,
+            reply.markdown,
+            "markdown",
+            reply.replyMarkup ?? { inline_keyboard: [] },
+          );
+        } catch (error) {
+          editFailed = true;
+          deps.recordRuntimeEvent("generative-app", error, {
+            phase: "bound-action-edit-fallback",
+            app: boundAction.app,
+            method: boundAction.method,
+          });
+        }
+        deps.assertExecutionCurrent(query);
+        if (!editFailed) return "edit";
+      }
+      deps.assertExecutionCurrent(query);
+      await deps.sendMarkdownReply(chatId, messageId, reply.markdown, {
+        replyMarkup: reply.replyMarkup,
+      });
+      deps.assertExecutionCurrent(query);
+      return "new";
+    } catch (error) {
+      deps.recordRuntimeEvent("generative-app", error, {
+        phase: "bound-action",
+        ...(boundAction
+          ? { app: boundAction.app, method: boundAction.method }
+          : {}),
+      });
+      throw error;
+    }
+  };
+}
+
 export interface TelegramAgentMessageToolRoutingRuntime {
   resolveAgentTarget: TelegramAgentTargetResolver;
   routeAgentMessage: TelegramAgentMessageRouter;
@@ -331,6 +429,7 @@ export function createTelegramActivityBindingRuntime<TTransportStamp>(deps: {
 
 interface TelegramCommandsAndToolsBindingDeps {
   pi: Pi.ExtensionAPI;
+  agentDir: string;
   configStore: Config.TelegramConfigStore;
   persistConfig: (config?: Config.TelegramConfig) => Promise<void>;
   setup: Setup.TelegramSetupGuard;
@@ -348,7 +447,10 @@ interface TelegramCommandsAndToolsBindingDeps {
     chatId: number,
     replyToMessageId: number | undefined,
     markdown: string,
-    options?: { replyMarkup?: unknown },
+    options?: {
+      replyMarkup?: unknown;
+      target?: { chatId: number; threadId?: number };
+    },
   ) => Promise<number | undefined>;
   callMultipart: OutboundHandlers.TelegramVoiceReplySenderDeps["sendMultipart"];
   getDefaultChatId: () => number | undefined;
@@ -362,6 +464,7 @@ interface TelegramCommandsAndToolsBindingDeps {
 
 export function registerTelegramCommandsAndTools({
   pi,
+  agentDir,
   configStore,
   persistConfig,
   setup,
@@ -383,6 +486,13 @@ export function registerTelegramCommandsAndTools({
   recordRuntimeEvent,
   updateStatus,
 }: TelegramCommandsAndToolsBindingDeps): void {
+  GenerativeApps.registerTelegramBindTool(pi, {
+    agentDir,
+    getActiveTurn: activeTurnRuntime.get,
+    planOutput: OutboundHandlers.createTelegramOutboundReplyPlanner(buttonActionStore),
+    sendMarkdownReply,
+    recordRuntimeEvent,
+  });
   OutboundAttachments.registerTelegramOutboundAttachmentTool(pi, {
     getActiveTurn: activeTurnRuntime.get,
     getDefaultChatId,

package/lib/generative-app-worker.mjs

@@ -0,0 +1,104 @@
+/**
+ * Generative App isolated method worker
+ * Zones: managed Generative App execution, bounded local processes
+ * Owns one terminable app-method invocation and its child-process cleanup
+ */
+
+import { execFile } from "node:child_process";
+import { parentPort, workerData } from "node:worker_threads";
+import { pathToFileURL } from "node:url";
+
+if (!parentPort) throw new Error("Generative App worker requires a parent port.");
+
+const controller = new AbortController();
+const runningChildren = new Set();
+parentPort.on("message", (message) => {
+  if (message?.type !== "abort") return;
+  controller.abort();
+  for (const child of runningChildren) child.kill();
+  parentPort.postMessage({ type: "abort-ack" });
+});
+
+function runBoundedProcess(input) {
+  if (!input || typeof input !== "object") {
+    throw new Error("Generative App run input must be an object.");
+  }
+  const command = input.command?.trim();
+  if (!command) throw new Error("Generative App run.command is required.");
+  if (!Array.isArray(input.args ?? []) || (input.args?.length ?? 0) > workerData.runMaxArgs) {
+    throw new Error(`Generative App run.args accepts at most ${workerData.runMaxArgs} strings.`);
+  }
+  const args = (input.args ?? []).map((argument) => {
+    if (typeof argument !== "string") throw new Error("Generative App run.args must contain strings.");
+    return argument;
+  });
+  if (!input.cwd || typeof input.cwd !== "string") {
+    throw new Error("Generative App run.cwd is required.");
+  }
+  const timeoutMs = Math.min(
+    workerData.runMaxTimeoutMs,
+    Math.max(1, Math.round(input.timeoutMs ?? workerData.methodTimeoutMs)),
+  );
+  return new Promise((resolve, reject) => {
+    const child = execFile(
+      command,
+      args,
+      {
+        cwd: input.cwd,
+        encoding: "utf8",
+        maxBuffer: workerData.runMaxStreamBytes,
+        shell: false,
+        signal: controller.signal,
+        timeout: timeoutMs,
+        windowsHide: true,
+      },
+      (error, stdout, stderr) => {
+        runningChildren.delete(child);
+        if (error && error.code !== "ABORT_ERR") {
+          resolve({
+            code: typeof error.code === "number" ? error.code : 1,
+            killed: error.killed === true,
+            stderr: String(stderr).slice(-workerData.runMaxStreamBytes),
+            stdout: String(stdout).slice(-workerData.runMaxStreamBytes),
+          });
+          return;
+        }
+        if (error) {
+          reject(error);
+          return;
+        }
+        resolve({
+          code: 0,
+          killed: false,
+          stderr: String(stderr),
+          stdout: String(stdout),
+        });
+      },
+    );
+    runningChildren.add(child);
+  });
+}
+
+try {
+  const module = await import(pathToFileURL(workerData.modulePath).href);
+  if (typeof module.init !== "function") {
+    throw new Error(`Generative App ${workerData.app} must export named function init.`);
+  }
+  const method = module[workerData.method];
+  if (typeof method !== "function") {
+    throw new Error(`Generative App ${workerData.app} does not export method ${workerData.method}.`);
+  }
+  const result = await method({
+    ...(workerData.argumentPresent ? { argument: workerData.argument } : {}),
+    revision: workerData.revision,
+    run: runBoundedProcess,
+    signal: controller.signal,
+    ...(workerData.statePresent ? { state: workerData.state } : {}),
+  });
+  parentPort.postMessage({ ok: true, result });
+} catch (error) {
+  parentPort.postMessage({
+    ok: false,
+    error: error instanceof Error ? error.message : String(error),
+  });
+}