@miphamai/cli 0.14.0 → 0.16.0

package/src/ui/commands.ts

@@ -10,6 +10,7 @@ import type { SkillsLoader } from '../skills/loader'
 import type { PluginManager } from '../plugin/plugin-manager'
 import { McpClient } from '../mcp/client'
 import { NPM_INSTALL_COMMAND, NPM_UPDATE_COMMAND, PACKAGE_VERSION } from '../shared/index.ts'
+import { getPreference } from '../config/preferences'
 
 export interface CommandContext {
   engine: QueryEngine
@@ -17,6 +18,7 @@ export interface CommandContext {
   providerId: string
   modelId: string
   version: string
+  sessionId: string
   // Callbacks for commands that mutate App state
   setSessionTitle: (title: string) => void
   setFastMode: (on: boolean) => void
@@ -689,22 +691,47 @@ const recapCmd: CommandHandler = (ctx) => {
 
 const usageCmd: CommandHandler = (ctx) => {
   const c = ctx.engine.getContext()
-  const tokens = c.getEstimatedTokens()
+  const estTokens = c.getEstimatedTokens()
   const msgs = c.getMessages()
   const maxTokens = 200_000
-  const pct = ((tokens / maxTokens) * 100).toFixed(1)
+  const pct = ((estTokens / maxTokens) * 100).toFixed(1)
+
+  const tracker = ctx.engine.getUsageTracker()
+  const summary = tracker.getSummary()
+
+  // Build per-tool breakdown
+  const toolLines: string[] = []
+  const sortedTools = Object.entries(summary.tools).sort(
+    (a, b) => b[1].inputTokens + b[1].outputTokens - (a[1].inputTokens + a[1].outputTokens),
+  )
+  for (const [name, usage] of sortedTools) {
+    const total = usage.inputTokens + usage.outputTokens
+    const prefix = name.startsWith('mcp__') ? '🔌 ' : '  '
+    toolLines.push(
+      `${prefix}${name.padEnd(18)} ${total.toLocaleString().padStart(8)} tokens (${usage.calls} call${usage.calls !== 1 ? 's' : ''})`,
+    )
+  }
+
+  const apiTotal = summary.apiInputTokens + summary.apiOutputTokens
+  const apiLine =
+    summary.apiInputTokens > 0 || summary.apiOutputTokens > 0
+      ? `API tokens:      ${summary.apiInputTokens.toLocaleString().padStart(8)} in / ${summary.apiOutputTokens.toLocaleString().padStart(6)} out (${apiTotal.toLocaleString()} total)`
+      : 'API tokens:      (no API usage data yet)'
+
+  const toolSection = toolLines.length > 0 ? `\n── Per-Tool ──\n${toolLines.join('\n')}` : ''
 
   return {
     content: stripIndent`
       ── Usage Dashboard ──
-      Context tokens:  ~${tokens.toLocaleString()} / ${maxTokens.toLocaleString()}  (${pct}%)
+      ${apiLine}
+      Context tokens:  ~${estTokens.toLocaleString()} / ${maxTokens.toLocaleString()}  (${pct}%)
       Messages:         ${msgs.length}
       Provider:         ${ctx.providerId}
       Model:            ${ctx.modelId}
 
       ${'█'.repeat(Math.ceil(Number(pct) / 5))}${'░'.repeat(20 - Math.ceil(Number(pct) / 5))} ${pct}%
+      ${toolSection}
 
-      Note: Token counting is approximate (chars/4).
       Use /context for detailed stats, /compact to free space.
     `,
   }
@@ -774,7 +801,7 @@ const browseSkillsCmd: CommandHandler = async () => {
   return { content: lines.join('\n') }
 }
 
-const installSkillCmd: CommandHandler = async (_ctx, args) => {
+const installSkillCmd: CommandHandler = async (ctx, args) => {
   const { installSkill, installSkillFromUrl } = await import('../skills/registry')
 
   const target = args[0]
@@ -782,12 +809,13 @@ const installSkillCmd: CommandHandler = async (_ctx, args) => {
     return { content: 'Usage: /install-skill <skill-name> or /install-skill <url>' }
   }
 
+  const marketplaceConfig = ctx.config.marketplace
   let result: { success: boolean; name: string; message: string }
 
   if (target.startsWith('http://') || target.startsWith('https://')) {
-    result = installSkillFromUrl(target)
+    result = installSkillFromUrl(target, marketplaceConfig)
   } else {
-    result = installSkill(target)
+    result = installSkill(target, marketplaceConfig)
   }
 
   return {
@@ -1656,7 +1684,7 @@ function gitDiffBridgeCmd(opts: {
   label: string
   noChangesHint: string
   runningMsg: string
-  forwardToAI: string
+  forwardToAI: string | (() => string)
 }): CommandHandler {
   return async () => {
     try {
@@ -1667,7 +1695,7 @@ function gitDiffBridgeCmd(opts: {
       }
       return {
         content: `─ ${opts.label} ─\n\n${opts.runningMsg}\n\nChanged files:\n${diff}`,
-        forwardToAI: opts.forwardToAI,
+        forwardToAI: typeof opts.forwardToAI === 'function' ? opts.forwardToAI() : opts.forwardToAI,
       }
     } catch {
       return {
@@ -1683,8 +1711,8 @@ const codeReviewCmd = gitDiffBridgeCmd({
     'No uncommitted changes to review.\n\nTo review a specific file: /code-review path/to/file.ts',
   runningMsg:
     'Reviewing uncommitted changes with the code-review skill (7 dimensions: correctness, security, performance, code quality, architecture, testing, language-specific)...',
-  forwardToAI:
-    'use the code-review skill to review all uncommitted changes. Check all 7 dimensions: correctness, security, performance, code quality, architecture & design, testing, and language-specific issues.',
+  forwardToAI: () =>
+    `use the code-review skill to review all uncommitted changes. Check all 7 dimensions: correctness, security, performance, code quality, architecture & design, testing, and language-specific issues. Use effort level: ${getPreference('lastCodeReviewEffort', 'high')}.`,
 })
 
 const simplifyCmd = gitDiffBridgeCmd({
@@ -1862,7 +1890,7 @@ const summaryCmd: CommandHandler = (ctx) => {
   }
 }
 
-const cdCmd: CommandHandler = async (_ctx, args) => {
+const cdCmd: CommandHandler = async (ctx, args) => {
   const target = args[0]
   if (!target) {
     return {
@@ -1887,6 +1915,22 @@ const cdCmd: CommandHandler = async (_ctx, args) => {
 
   try {
     process.chdir(resolved)
+
+    // Persist cwd to active session (best-effort)
+    try {
+      const { SessionStore } = await import('../core/session-store')
+      const saved = SessionStore.load(ctx.sessionId)
+      if (saved) {
+        SessionStore.save(ctx.sessionId, saved.messages, {
+          provider: saved.metadata.provider,
+          model: saved.metadata.model,
+          cwd: resolved,
+        })
+      }
+    } catch {
+      /* session persistence is best-effort */
+    }
+
     return {
       content: [
         '── Directory Changed ──',
@@ -2014,48 +2058,10 @@ const exportCmd: CommandHandler = async (ctx) => {
 }
 
 // ═══════════════════════════════════════════════════════════════
-// Review — code review workflow
+// Review — alias for /code-review (P1: 2026-08-06 polish)
 // ═══════════════════════════════════════════════════════════════
 
-const reviewCmd: CommandHandler = async () => {
-  try {
-    const { execSync } = await import('node:child_process')
-    const diff = execSync('git diff --stat', { encoding: 'utf-8', timeout: 5000 }).trim()
-    const unstaged = execSync('git diff --name-only', { encoding: 'utf-8', timeout: 3000 }).trim()
-    const staged = execSync('git diff --cached --name-only', {
-      encoding: 'utf-8',
-      timeout: 3000,
-    }).trim()
-
-    if (!diff) {
-      return {
-        content:
-          '─ Code Review ─\n\nNo uncommitted changes detected.\n\nUse /pr-comments for PR-level review, or make changes first.',
-      }
-    }
-
-    const lines: string[] = ['─ Code Review ─', '', 'Uncommitted changes:', '', diff]
-
-    if (staged) {
-      lines.push('')
-      lines.push('Staged files (ready for commit):')
-      for (const f of staged.split('\n')) lines.push(`  ✓ ${f}`)
-    }
-    if (unstaged) {
-      lines.push('')
-      lines.push('Unstaged files (working directory):')
-      for (const f of unstaged.split('\n')) lines.push(`  • ${f}`)
-    }
-
-    lines.push('')
-    lines.push('To review with AI: type "review these changes" in chat.')
-    lines.push('To commit: git add -A && git commit -m "..."')
-
-    return { content: lines.join('\n') }
-  } catch {
-    return { content: '─ Code Review ─\n\nCould not run git diff. Are you in a git repository?' }
-  }
-}
+const reviewCmd = codeReviewCmd
 
 // ═══════════════════════════════════════════════════════════════
 // PR Comments
@@ -4093,8 +4099,14 @@ const forkCmd: CommandHandler = async (ctx, args) => {
     'general',
     async (_signal) => {
       const { SubAgent } = await import('../agent/sub-agent')
-      const sa = new SubAgent(ctx.engine.getRegistry(), ctx.engine.getTools())
-      const result = await sa.execute(prompt, 'fork: ' + prompt.slice(0, 60), {})
+      const sa = new SubAgent(
+        ctx.engine.getRegistry(),
+        ctx.engine.getTools(),
+        ctx.engine.getPermission(),
+      )
+      const result = await sa.execute(prompt, 'fork: ' + prompt.slice(0, 60), {
+        worktreePath: wtPath,
+      })
       try {
         const { execSync: ex } = await import('node:child_process')
         ex(`git -C ${wtPath} add -A`, { stdio: 'ignore', timeout: 10_000 })
@@ -4289,7 +4301,7 @@ const commandsListCmd: CommandHandler = () => {
     '/tdd': 'Workflow',
     '/todos': 'Workflow',
     '/tasks': 'Workflow',
-    '/review': 'Workflow',
+    '/review': 'Code Quality',
     '/pr-comments': 'Workflow',
     '/diff': 'Workflow',
     '/workflows': 'Workflow',
@@ -4556,7 +4568,7 @@ const COMMAND_DESCRIPTIONS: Record<string, string> = {
   '/tdd': 'Test-Driven Development workflow (RED → GREEN → REFACTOR)',
   '/todos': 'Task management (list/create tasks)',
   '/tasks': 'Background tasks',
-  '/review': 'Code review workflow',
+  '/review': 'Review code for bugs, security, performance (alias for /code-review)',
   '/pr-comments': 'PR review summary',
   '/diff': 'Show git diff',
   '/workflows': 'List workflow scripts',

package/src/workflow/primitives/agent.ts

@@ -1,6 +1,7 @@
 import { SubAgent } from '../../agent/sub-agent'
 import type { ProviderRegistry } from '../../providers/registry'
 import type { ToolDefinition } from '../../shared/index.ts'
+import type { PermissionSystem } from '../../core/permission'
 import { validateJSONSchema, formatValidationErrors } from '../schema-validator'
 
 export interface WorkflowAgentOpts {
@@ -12,17 +13,28 @@ export interface WorkflowAgentOpts {
   effort?: 'low' | 'medium' | 'high' | 'max'
   /** Maximum retries on schema validation failure (default: 2). */
   maxRetries?: number
+  /** Permission system for sub-agent tool execution (optional). */
+  permissionSystem?: PermissionSystem
+  /** Run the agent in an isolated git worktree (optional). */
+  isolation?: 'worktree'
 }
 
 /**
  * Workflow agent() primitive — creates a SubAgent with optional
- * provider/model override and structured output schema validation.
+ * provider/model override, structured output schema validation,
+ * and git worktree isolation.
  *
  * When `schema` is provided:
  *   1. The sub-agent is prompted to return valid JSON matching the schema.
  *   2. The result is JSON.parsed and validated against the schema.
  *   3. On validation failure, the sub-agent is retried with error feedback.
  *   4. Returns the validated object, or { raw, validationErrors } on final failure.
+ *
+ * When `isolation: 'worktree'` is set:
+ *   1. A git worktree is created at .claude/worktrees/wf-<slug>
+ *   2. The sub-agent runs with its cwd set to the worktree path
+ *   3. Changes are auto-committed (best-effort)
+ *   4. The worktree is cleaned up after execution
  */
 export async function workflowAgent(
   prompt: string,
@@ -39,6 +51,26 @@ export async function workflowAgent(
 
   const maxRetries = opts.maxRetries ?? 2
 
+  // ── Worktree isolation setup ──
+  let worktreePath: string | undefined
+  let worktreeBranch: string | undefined
+
+  if (opts.isolation === 'worktree') {
+    const slug = `wf-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`
+    worktreeBranch = `worktree/${slug}`
+    worktreePath = `.claude/worktrees/${slug}`
+
+    const proc = Bun.spawn(['git', 'worktree', 'add', '-b', worktreeBranch, worktreePath, 'HEAD'], {
+      stdout: 'pipe',
+      stderr: 'pipe',
+    })
+    const exitCode = await proc.exited
+    if (exitCode !== 0) {
+      const stderr = await new Response(proc.stderr).text()
+      throw new Error(`Worktree creation failed: ${stderr.slice(0, 500)}`)
+    }
+  }
+
   // Build the prompt — if schema is requested, instruct the model to return JSON
   let effectivePrompt = prompt
   if (opts.schema) {
@@ -50,64 +82,118 @@ export async function workflowAgent(
       `Return ONLY the JSON object, no other text. Do not wrap in markdown code fences.`
   }
 
-  const sub = new SubAgent(registry, toolRegistry)
+  const sub = new SubAgent(registry, toolRegistry, opts.permissionSystem)
 
-  // ── Attempt execution with optional schema validation + retry ──
+  // ── Execute with optional schema validation + retry ──
+  let result: unknown = ''
   let lastResult = ''
   let lastErrors: string[] = []
 
-  for (let attempt = 0; attempt <= maxRetries; attempt++) {
-    const retryPrompt =
-      attempt === 0
-        ? effectivePrompt
-        : `${effectivePrompt}\n\n` +
-          `[RETRY #${attempt}] Your previous response did NOT match the required schema.\n` +
-          `Validation errors:\n${lastErrors.map((e) => `  • ${e}`).join('\n')}\n\n` +
-          `Please fix the errors and return a valid JSON object matching the schema exactly.`
-
-    const result = await sub.execute(retryPrompt, opts.label || 'workflow-agent', {
-      type: 'general',
-      modelOverride: opts.model,
-      allowedTools: undefined, // use all tools by default
-    })
+  try {
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+      const retryPrompt =
+        attempt === 0
+          ? effectivePrompt
+          : `${effectivePrompt}\n\n` +
+            `[RETRY #${attempt}] Your previous response did NOT match the required schema.\n` +
+            `Validation errors:\n${lastErrors.map((e) => `  • ${e}`).join('\n')}\n\n` +
+            `Please fix the errors and return a valid JSON object matching the schema exactly.`
 
-    lastResult = result
+      const textResult = await sub.execute(retryPrompt, opts.label || 'workflow-agent', {
+        type: 'general',
+        modelOverride: opts.model,
+        allowedTools: undefined, // use all tools by default
+        worktreePath,
+      })
 
-    // No schema — return raw result
-    if (!opts.schema) {
-      return result
-    }
+      lastResult = textResult
 
-    // Try to parse and validate
-    try {
-      // Extract JSON from potential markdown fences
-      let jsonStr = result.trim()
-      const fenceMatch = jsonStr.match(/```(?:json)?\s*\n?([\s\S]*?)\n?```/)
-      if (fenceMatch) {
-        jsonStr = fenceMatch[1]!.trim()
+      // No schema — return raw result
+      if (!opts.schema) {
+        result = textResult
+        return result
       }
 
-      const parsed = JSON.parse(jsonStr)
-      const errors = validateJSONSchema(parsed, opts.schema as Record<string, unknown>)
+      // Try to parse and validate
+      try {
+        // Extract JSON from potential markdown fences
+        let jsonStr = textResult.trim()
+        const fenceMatch = jsonStr.match(/```(?:json)?\s*\n?([\s\S]*?)\n?```/)
+        if (fenceMatch) {
+          jsonStr = fenceMatch[1]!.trim()
+        }
 
-      if (errors.length === 0) {
-        // Valid! Return the parsed object
-        return parsed
+        const parsed = JSON.parse(jsonStr)
+        const errors = validateJSONSchema(parsed, opts.schema as Record<string, unknown>)
+
+        if (errors.length === 0) {
+          // Valid! Return the parsed object
+          result = parsed
+          return result
+        }
+
+        // Not valid — collect errors for retry
+        lastErrors = [formatValidationErrors(errors)]
+      } catch (err) {
+        // JSON parse error
+        lastErrors = [`JSON parse error: ${String(err)}. Ensure your response is valid JSON only.`]
       }
+    }
 
-      // Not valid — collect errors for retry
-      lastErrors = [formatValidationErrors(errors)]
-    } catch (err) {
-      // JSON parse error
-      lastErrors = [`JSON parse error: ${String(err)}. Ensure your response is valid JSON only.`]
+    // All retries exhausted — return raw result with validation errors
+    try {
+      const parsed = JSON.parse(lastResult)
+      result = { raw: lastResult, parsed, validationErrors: lastErrors }
+    } catch {
+      result = { raw: lastResult, validationErrors: lastErrors }
     }
-  }
 
-  // All retries exhausted — return raw result with validation errors
-  try {
-    const parsed = JSON.parse(lastResult)
-    return { raw: lastResult, parsed, validationErrors: lastErrors }
-  } catch {
-    return { raw: lastResult, validationErrors: lastErrors }
+    return result
+  } finally {
+    // ── Cleanup worktree ──
+    if (worktreePath) {
+      // Best-effort: auto-commit any changes
+      try {
+        const addProc = Bun.spawn(['git', '-C', worktreePath, 'add', '-A'], {
+          stdout: 'pipe',
+          stderr: 'pipe',
+        })
+        await addProc.exited
+
+        const statusProc = Bun.spawn(['git', '-C', worktreePath, 'status', '--porcelain'], {
+          stdout: 'pipe',
+          stderr: 'pipe',
+        })
+        const status = await new Response(statusProc.stdout).text()
+        if (status.trim()) {
+          const commitMsg = opts.label ? `workflow: ${opts.label}` : 'workflow: agent changes'
+          const commitProc = Bun.spawn(['git', '-C', worktreePath, 'commit', '-m', commitMsg], {
+            stdout: 'pipe',
+            stderr: 'pipe',
+          })
+          await commitProc.exited
+        }
+      } catch {
+        /* best-effort */
+      }
+
+      // Remove worktree and branch
+      try {
+        const rmProc = Bun.spawn(['git', 'worktree', 'remove', '--force', worktreePath], {
+          stdout: 'pipe',
+          stderr: 'pipe',
+        })
+        await rmProc.exited
+        if (worktreeBranch) {
+          const brProc = Bun.spawn(['git', 'branch', '-D', worktreeBranch], {
+            stdout: 'pipe',
+            stderr: 'pipe',
+          })
+          await brProc.exited
+        }
+      } catch {
+        /* best-effort */
+      }
+    }
   }
 }

package/src/workflow/runtime.ts

@@ -1,3 +1,4 @@
+import vm from 'node:vm'
 import { createSandbox } from './sandbox'
 import { createJournal, appendJournal, loadJournal, loadScript } from './journal'
 import { createBudget } from './budget'
@@ -47,7 +48,8 @@ function agentCacheKey(prompt: string, opts: Record<string, unknown> = {}): stri
  *   - Returns cacheHits and cacheMisses counts
  *
  * The sandbox blocks non-deterministic APIs (Date.now, Math.random) to make
- * this deterministic replay possible.
+ * this deterministic replay possible. Scripts execute inside a node:vm.Context
+ * that blocks sandbox escape vectors (eval, Function, import, require, process, etc.).
  */
 export async function runWorkflow(
   script: string,
@@ -96,6 +98,7 @@ export async function runWorkflow(
 
   const registry: ProviderRegistry = engine.getRegistry()
   const toolRegistry = engine.getTools()
+  const permission = engine.getPermission()
 
   const budget = createBudget(budgetTotal)
 
@@ -111,12 +114,10 @@ export async function runWorkflow(
     }
     cacheMisses++
 
-    const result = await workflowAgent(
-      prompt,
-      registry,
-      toolRegistry,
-      opts as Record<string, unknown>,
-    )
+    const result = await workflowAgent(prompt, registry, toolRegistry, {
+      ...(opts || {}),
+      permissionSystem: permission,
+    } as Record<string, unknown>)
     appendJournal(runId, {
       type: 'agent',
       prompt,
@@ -135,42 +136,28 @@ export async function runWorkflow(
     appendJournal(runId, { type: 'log', message })
   }
 
-  const sandbox = createSandbox(args, budget)
-
   // Build the script wrapper
   const wrappedScript = `
-    return (async () => {
+    (async () => {
       ${script}
     })()
   `
 
-  // Execute in sandboxed context
-  const scriptFn = new Function(
-    'agent',
-    'parallel',
-    'pipeline',
-    'verify',
-    'judge',
-    'loopUntilConvergence',
-    'phase',
-    'log',
-    'args',
-    'budget',
-    wrappedScript,
-  )
-
-  const result = await scriptFn(
-    agent,
-    parallel,
-    pipeline,
-    verify,
-    judge,
-    loopUntilConvergence,
-    wrappedPhase,
-    log,
-    args,
-    budget,
-  )
+  // Execute in node:vm sandbox — no access to host globals
+  const vmScript = new vm.Script(wrappedScript, { filename: 'workflow.js' })
+  const sandboxCtx = createSandbox(args, budget)
+
+  // Inject primitives into the sandbox context (whitelist approach)
+  sandboxCtx.agent = agent
+  sandboxCtx.parallel = parallel
+  sandboxCtx.pipeline = pipeline
+  sandboxCtx.verify = verify
+  sandboxCtx.judge = judge
+  sandboxCtx.loopUntilConvergence = loopUntilConvergence
+  sandboxCtx.phase = wrappedPhase
+  sandboxCtx.log = log
+
+  const result = await vmScript.runInContext(sandboxCtx, { timeout: 120_000 })
 
   // Count journal entries from state
   const priorEntries = loadJournal(runId)

package/src/workflow/sandbox.ts

@@ -1,27 +1,39 @@
-/** APIs disabled in workflow scripts to ensure deterministic replay. */
+import vm from 'node:vm'
+
+/** APIs disabled in workflow scripts to ensure deterministic replay + sandbox escape prevention. */
 const FORBIDDEN = new Set(['Date.now', 'Math.random', 'crypto.randomUUID'])
 
 /**
- * Create a sandboxed global scope for workflow script execution.
- * Blocks Date.now(), Math.random(), argless new Date(), crypto.randomUUID().
+ * Create a sandboxed VM context for workflow script execution.
+ * Blocks Date.now(), Math.random(), argless new Date(), crypto.randomUUID(),
+ * plus explicit sandbox escape vectors: eval, Function constructor, import(),
+ * require(), process, Bun, fetch, setTimeout/setInterval, etc.
  */
 export function createSandbox(
   args: unknown,
   budget: { total: number | null; spent(): number; remaining(): number },
-): Record<string, unknown> {
-  const sandbox: Record<string, unknown> = {
+): vm.Context {
+  const sandboxObj: Record<string, unknown> = {
     args,
     budget,
     console: {
       log: (..._a: unknown[]) => {}, // no-op in sandbox
       error: (..._a: unknown[]) => {},
     },
-    // Primitives are injected by the runtime, not the sandbox
+
+    // ── Explicit sandbox escape prevention ──
+    // V8 builtins that would otherwise be available in a vm.Context
+    eval: () => {
+      throw new Error('eval() is disabled in workflow sandbox.')
+    },
+    Function: () => {
+      throw new Error('new Function() is disabled in workflow sandbox.')
+    },
   }
 
   // Override Date to block now() and argless constructor
   const OriginalDate = Date
-  sandbox.Date = new Proxy(OriginalDate, {
+  sandboxObj.Date = new Proxy(OriginalDate, {
     construct(_target, constructorArgs) {
       if (constructorArgs.length === 0) {
         throw new Error('new Date() is disabled in workflow sandbox. Pass timestamps via args.')
@@ -42,7 +54,7 @@ export function createSandbox(
   })
 
   // Override Math.random
-  sandbox.Math = new Proxy(Math, {
+  sandboxObj.Math = new Proxy(Math, {
     get(_target, prop) {
       if (prop === 'random') {
         throw new Error('Math.random() is disabled in workflow sandbox. Use a seed from args.')
@@ -57,7 +69,7 @@ export function createSandbox(
     | { randomUUID?: unknown; [key: string]: unknown }
     | undefined
   if (globalCrypto) {
-    sandbox.crypto = new Proxy(globalCrypto, {
+    sandboxObj.crypto = new Proxy(globalCrypto, {
       get(_target, prop) {
         if (prop === 'randomUUID') {
           throw new Error('crypto.randomUUID() is disabled in workflow sandbox.')
@@ -70,7 +82,7 @@ export function createSandbox(
     })
   }
 
-  return sandbox
+  return vm.createContext(sandboxObj)
 }
 
 /** Check whether a given API identifier is in the forbidden set. */