@oxygen-agent/cli 1.720.7 → 1.739.1

package/node_modules/@oxygen/workflows/dist/graph/lint.js

@@ -6,12 +6,13 @@
 // validateTrigger from ../index.js, which pulls node:vm and node:crypto. This is
 // why ./index.ts (the "@oxygen/workflows/graph" entry) does not re-export this
 // module — the editor lints through the API, not in the bundle.
+import * as vm from "node:vm";
 import { validateFormulaExpression } from "@oxygen/formula";
-import { isWorkflowToolRejected, lintRecipeManifest, validateOptionalMaxCredits, validatePureFunctionSource, validateTrigger, } from "../index.js";
+import { isWorkflowToolRejected, lintRecipeManifest, lintWorkflowCodeSourceSafety, validateOptionalMaxCredits, validatePureFunctionSource, validateTrigger, } from "../index.js";
 import { UNARY_COMPARE_OPS, WORKFLOW_COMPARE_OPS, compileConditionPattern, parseScopePath, SCOPE_PATH_ROOTS, } from "./expression.js";
 import { missingToolParams, unknownToolParams } from "./params.js";
-import { danglingEdges, findIllegalCycles, loopBodyNodeIds, reachableNodeIds } from "./topology.js";
-import { MAX_WORKFLOW_LOOP_ITERATIONS, MAX_WORKFLOW_NODE_RETRY_ATTEMPTS, MAX_WORKFLOW_NODE_RETRY_WAIT_SECONDS, RESERVED_EDGE_HANDLES, RESERVED_NODE_IDS, WORKFLOW_GRAPH_COMPILER_VERSION, WORKFLOW_GRAPH_MANIFEST_VERSION, LOOP_BODY_HANDLE, LOOP_DONE_HANDLE, } from "./types.js";
+import { danglingEdges, findIllegalCycles, loopBodyNodeIds, reachableNodeIds, workflowCodeSandboxInvocationUpperBound, } from "./topology.js";
+import { MAX_WORKFLOW_LOOP_ITERATIONS, MAX_WORKFLOW_NODE_RETRY_ATTEMPTS, MAX_WORKFLOW_NODE_RETRY_WAIT_SECONDS, RESERVED_EDGE_HANDLES, RESERVED_NODE_IDS, isWorkflowCodeFieldName, WORKFLOW_CODE_V1_LANGUAGE, WORKFLOW_CODE_V1_MAX_INPUT_BYTES, WORKFLOW_CODE_V1_MAX_INPUTS, WORKFLOW_CODE_V1_MAX_OUTPUT_BYTES, WORKFLOW_CODE_V1_MAX_SCHEMA_BYTES, WORKFLOW_CODE_V1_MAX_SCHEMA_DEPTH, WORKFLOW_CODE_V1_MAX_SCHEMA_NODES, WORKFLOW_CODE_V1_MAX_SCHEMA_PROPERTIES, WORKFLOW_CODE_V1_MAX_SANDBOX_INVOCATIONS_PER_RUN, WORKFLOW_CODE_V1_MAX_SOURCE_BYTES, WORKFLOW_CODE_V1_MAX_TIMEOUT_MS, WORKFLOW_CODE_V1_MIN_INPUT_BYTES, WORKFLOW_CODE_V1_MIN_OUTPUT_BYTES, WORKFLOW_CODE_V1_MIN_TIMEOUT_MS, WORKFLOW_CODE_V1_RUNTIME, WORKFLOW_CODE_V1_VERSION, WORKFLOW_GRAPH_COMPILER_VERSION, WORKFLOW_GRAPH_MANIFEST_VERSION, LOOP_BODY_HANDLE, LOOP_DONE_HANDLE, } from "./types.js";
 const NODE_KINDS = new Set([
     "trigger",
     "tool",
@@ -31,6 +32,53 @@ const STEP_MODES = new Set(["dry_run", "live", "smoke_test"]);
 // A condition tree is authored in a UI; anything deeper than this is either a
 // generator gone wrong or an attempt to make the linter recurse forever.
 const MAX_CONDITION_DEPTH = 12;
+const WORKFLOW_CODE_JSON_TYPES = new Set([
+    "array",
+    "boolean",
+    "integer",
+    "null",
+    "number",
+    "object",
+    "string",
+]);
+const WORKFLOW_CODE_SCHEMA_KEYWORDS = new Set([
+    "type",
+    "const",
+    "enum",
+    "anyOf",
+    "properties",
+    "required",
+    "additionalProperties",
+    "items",
+    "title",
+    "description",
+    "default",
+    "examples",
+]);
+const WORKFLOW_CODE_SCHEMA_ANNOTATIONS = new Set([
+    "title",
+    "description",
+    "default",
+    "examples",
+]);
+const WORKFLOW_CODE_FIELDS = new Set([
+    "version",
+    "language",
+    "runtime",
+    "source",
+    "inputs",
+    "output_schema",
+    "limits",
+]);
+const WORKFLOW_CODE_LIMIT_FIELDS = new Set([
+    "timeout_ms",
+    "max_input_bytes",
+    "max_output_bytes",
+]);
+// Code v1 deliberately takes one named input bag. Requiring the complete
+// expression (rather than a body snippet) makes the stored source portable to a
+// future executor without guessing how it should be wrapped.
+const WORKFLOW_CODE_FUNCTION_EXPRESSION = /^(?:(?:async\s+)?(?:\(\s*inputs\s*\)|inputs)\s*=>|(?:async\s+)?function(?:\s+[A-Za-z_$][\w$]*)?\s*\(\s*inputs\s*\))/;
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -88,6 +136,25 @@ export function assertWorkflowGraphManifest(value, options = {}) {
     const first = result.issues[0];
     throw new Error(first ? `${first.code}: ${first.message}` : "Invalid workflow graph manifest.");
 }
+/**
+ * Validate one nested oxygen-js-v1 envelope without requiring its surrounding
+ * graph. Runtime entry points call this again immediately before sandbox
+ * creation; ref syntax is checked here, while graph node reachability remains a
+ * manifest-lint concern.
+ */
+export function lintWorkflowCodeV1Contract(value) {
+    const issues = [];
+    const add = (path, code, message) => issues.push({ path, code, message });
+    lintWorkflowCodeV1(value, "$", add, UNSCOPED_NODE_SCOPE);
+    return { ok: issues.length === 0, issues };
+}
+export function assertWorkflowCodeV1Contract(value) {
+    const result = lintWorkflowCodeV1Contract(value);
+    if (result.ok)
+        return;
+    const first = result.issues[0];
+    throw new Error(first ? `${first.code}: ${first.message}` : "Invalid oxygen-js-v1 code contract.");
+}
 // ---------------------------------------------------------------------------
 // Manifest metadata
 // ---------------------------------------------------------------------------
@@ -108,6 +175,11 @@ function lintWorkflowMetadata(workflow, add) {
         add("$.workflow.status", "invalid_workflow_status", "Workflow status must be active or disabled.");
     }
 }
+const UNSCOPED_NODE_SCOPE = {
+    ids: new Set(),
+    loops: new Set(),
+    validateNodeIds: false,
+};
 function nodeScopeIndex(value) {
     const ids = new Set();
     const loops = new Set();
@@ -274,13 +346,19 @@ node, path, add, scope, options) {
     }
 }
 function lintCodeNode(node, path, add, scope, options) {
-    const hasSource = typeof node.run_source === "string";
-    const hasRecipe = isRecord(node.recipe);
-    if (hasSource === hasRecipe) {
-        add(path, "ambiguous_code_runtime", "A code node must declare exactly one executable runtime: run_source or recipe.");
+    const hasSource = node.run_source !== undefined;
+    const hasRecipe = node.recipe !== undefined;
+    const hasTypedCode = node.code !== undefined;
+    const runtimeCount = Number(hasSource) + Number(hasRecipe) + Number(hasTypedCode);
+    if (runtimeCount !== 1) {
+        add(path, "ambiguous_code_runtime", "A code node must declare exactly one executable runtime: run_source, recipe, or code.");
         return;
     }
     if (hasSource) {
+        if (typeof node.run_source !== "string") {
+            add(`${path}.run_source`, "unsafe_code_source", "Legacy code run_source must be a string.");
+            return;
+        }
         // v2 source nodes run through the same sandbox as v1 transform steps, so
         // they clear the same purity scan; every issue it raises is re-labelled to
         // the v2 code so callers match on one code for "this source is not safe".
@@ -291,6 +369,20 @@ function lintCodeNode(node, path, add, scope, options) {
         }
         return;
     }
+    if (hasTypedCode) {
+        lintWorkflowCodeV1(node.code, `${path}.code`, add, scope);
+        if (node.configuration !== undefined) {
+            add(`${path}.configuration`, "unexpected_recipe_configuration", "Typed code nodes do not use recipe configuration.");
+        }
+        if (node.legacy_context !== undefined) {
+            add(`${path}.legacy_context`, "unexpected_legacy_context", "Typed code nodes do not use legacy_context.");
+        }
+        return;
+    }
+    if (!isRecord(node.recipe)) {
+        add(`${path}.recipe`, "invalid_recipe_manifest", "Durable recipe runtime must be an object.");
+        return;
+    }
     // The graph owns configuration as value refs, which are resolved only at run
     // time. The standalone recipe linter validates concrete JSON values, so lint
     // the executable envelope without its literal configuration and validate the
@@ -332,6 +424,309 @@ function lintCodeNode(node, path, add, scope, options) {
         }
     }
 }
+function lintWorkflowCodeV1(value, path, add, scope) {
+    if (!isRecord(value)) {
+        add(path, "invalid_code_contract", "Typed code must be an oxygen-js-v1 object.");
+        return;
+    }
+    for (const key of Object.keys(value)) {
+        if (!WORKFLOW_CODE_FIELDS.has(key)) {
+            add(`${path}.${key}`, "unknown_code_field", `Typed code has no field called '${key}'.`);
+        }
+    }
+    if (value.version !== WORKFLOW_CODE_V1_VERSION) {
+        add(`${path}.version`, "invalid_code_version", `Typed code version must be ${WORKFLOW_CODE_V1_VERSION}.`);
+    }
+    if (value.language !== WORKFLOW_CODE_V1_LANGUAGE) {
+        add(`${path}.language`, "invalid_code_language", `Typed code language must be '${WORKFLOW_CODE_V1_LANGUAGE}'.`);
+    }
+    if (value.runtime !== WORKFLOW_CODE_V1_RUNTIME) {
+        add(`${path}.runtime`, "invalid_code_runtime", `Typed code runtime must be '${WORKFLOW_CODE_V1_RUNTIME}'.`);
+    }
+    lintWorkflowCodeSource(value.source, `${path}.source`, add);
+    lintWorkflowCodeInputs(value.inputs, `${path}.inputs`, add, scope);
+    lintWorkflowCodeOutputSchema(value.output_schema, `${path}.output_schema`, add);
+    lintWorkflowCodeLimits(value.limits, `${path}.limits`, add);
+}
+function lintWorkflowCodeSource(value, path, add) {
+    if (typeof value !== "string") {
+        add(path, "invalid_code_source", "Typed code source must be a complete JavaScript function expression.");
+        return;
+    }
+    if (Buffer.byteLength(value, "utf8") > WORKFLOW_CODE_V1_MAX_SOURCE_BYTES) {
+        add(path, "code_source_too_large", `Typed code source cannot exceed ${WORKFLOW_CODE_V1_MAX_SOURCE_BYTES} UTF-8 bytes.`);
+        return;
+    }
+    for (const issue of lintWorkflowCodeSourceSafety(value, path)) {
+        add(issue.path, "unsafe_code_source", issue.message);
+    }
+    const source = value.trim();
+    if (!WORKFLOW_CODE_FUNCTION_EXPRESSION.test(source)) {
+        add(path, "invalid_code_source", "Typed code source must be a complete function expression accepting one 'inputs' argument.");
+        return;
+    }
+    try {
+        // Compile only; never execute authored code during lint. Wrapping as an
+        // expression rejects legacy body snippets such as `return inputs.x;`.
+        new vm.Script(`"use strict";\nconst __oxygen_code = (\n${source}\n);`);
+    }
+    catch {
+        add(path, "invalid_code_source", "Typed code source is not a valid JavaScript function expression.");
+    }
+}
+function lintWorkflowCodeInputs(value, path, add, scope) {
+    if (!isRecord(value)) {
+        add(path, "invalid_code_inputs", "Typed code inputs must be an object of value refs.");
+        return;
+    }
+    const entries = Object.entries(value);
+    if (entries.length > WORKFLOW_CODE_V1_MAX_INPUTS) {
+        add(path, "too_many_code_inputs", `Typed code cannot declare more than ${WORKFLOW_CODE_V1_MAX_INPUTS} named inputs.`);
+    }
+    for (const [name, ref] of entries) {
+        if (!isNonEmptyString(name)) {
+            add(`${path}.${name}`, "invalid_code_input_name", "Typed code input names cannot be empty.");
+        }
+        else if (!isWorkflowCodeFieldName(name)) {
+            add(`${path}.${name}`, "invalid_code_input_name", `Typed code input '${name}' must be a JavaScript identifier with no dots or brackets and cannot be a reserved object key.`);
+        }
+        validateValueRef(ref, `${path}.${name}`, add, scope);
+        if (isRecord(ref) && ref.type === "literal" && !isJsonValue(ref.value)) {
+            add(`${path}.${name}.value`, "invalid_code_input_literal", "Typed code literal inputs must be strict JSON values (finite numbers; no undefined, functions, symbols, BigInt, cycles, or class instances).");
+        }
+        if (isRecord(ref) && (ref.type === "context_profile" || ref.type === "context_asset")) {
+            add(`${path}.${name}.type`, "unsupported_code_input_ref", "oxygen-js-v1 inputs cannot read context_profile or context_asset; bind explicit upstream data instead.");
+        }
+    }
+}
+function lintWorkflowCodeLimits(value, path, add) {
+    if (!isRecord(value)) {
+        add(path, "invalid_code_limits", "Typed code limits must declare timeout_ms, max_input_bytes, and max_output_bytes.");
+        return;
+    }
+    for (const key of Object.keys(value)) {
+        if (!WORKFLOW_CODE_LIMIT_FIELDS.has(key)) {
+            add(`${path}.${key}`, "unknown_code_limit", `Typed code limits have no field called '${key}'.`);
+        }
+    }
+    lintBoundedCodeInteger(value.timeout_ms, `${path}.timeout_ms`, WORKFLOW_CODE_V1_MIN_TIMEOUT_MS, WORKFLOW_CODE_V1_MAX_TIMEOUT_MS, add);
+    lintBoundedCodeInteger(value.max_input_bytes, `${path}.max_input_bytes`, WORKFLOW_CODE_V1_MIN_INPUT_BYTES, WORKFLOW_CODE_V1_MAX_INPUT_BYTES, add);
+    lintBoundedCodeInteger(value.max_output_bytes, `${path}.max_output_bytes`, WORKFLOW_CODE_V1_MIN_OUTPUT_BYTES, WORKFLOW_CODE_V1_MAX_OUTPUT_BYTES, add);
+}
+function lintBoundedCodeInteger(value, path, minimum, maximum, add) {
+    if (typeof value !== "number" || !Number.isInteger(value) || value < minimum || value > maximum) {
+        add(path, "invalid_code_limit", `Typed code limit must be an integer from ${minimum} through ${maximum}.`);
+    }
+}
+function lintWorkflowCodeOutputSchema(value, path, add) {
+    if (!isRecord(value)) {
+        add(path, "invalid_code_output_schema", "Typed code output_schema must be a closed object JSON Schema.");
+        return;
+    }
+    const serializedBytes = jsonByteLength(value);
+    if (serializedBytes === null) {
+        add(path, "invalid_code_output_schema", "Typed code output_schema must be JSON serializable.");
+    }
+    else if (serializedBytes > WORKFLOW_CODE_V1_MAX_SCHEMA_BYTES) {
+        add(path, "code_output_schema_too_large", `Typed code output_schema cannot exceed ${WORKFLOW_CODE_V1_MAX_SCHEMA_BYTES} UTF-8 bytes.`);
+    }
+    if (value.type !== "object") {
+        add(`${path}.type`, "invalid_code_output_schema", "Typed code output_schema must have top-level type 'object'.");
+    }
+    const state = {
+        propertyCount: 0,
+        propertyLimitReported: false,
+        nodeCount: 0,
+        nodeLimitReported: false,
+        depthLimitReported: false,
+        ancestors: new Set(),
+    };
+    lintWorkflowCodeSchemaNode(value, path, add, state, 1);
+}
+function lintWorkflowCodeSchemaNode(// skipcq: JS-R1005 -- one recursive pass keeps the supported schema subset coherent.
+schema, path, add, state, depth) {
+    state.nodeCount += 1;
+    if (state.nodeCount > WORKFLOW_CODE_V1_MAX_SCHEMA_NODES) {
+        if (!state.nodeLimitReported) {
+            add(path, "code_output_schema_too_complex", `Typed code output_schema cannot contain more than ${WORKFLOW_CODE_V1_MAX_SCHEMA_NODES} schema nodes.`);
+            state.nodeLimitReported = true;
+        }
+        return;
+    }
+    if (depth > WORKFLOW_CODE_V1_MAX_SCHEMA_DEPTH) {
+        if (!state.depthLimitReported) {
+            add(path, "code_output_schema_too_deep", `Typed code output_schema cannot exceed ${WORKFLOW_CODE_V1_MAX_SCHEMA_DEPTH} schema levels.`);
+            state.depthLimitReported = true;
+        }
+        return;
+    }
+    if (state.ancestors.has(schema)) {
+        add(path, "invalid_code_output_schema", "Typed code output_schema cannot contain a recursive object reference.");
+        return;
+    }
+    state.ancestors.add(schema);
+    const keys = Object.keys(schema);
+    for (const key of keys) {
+        if (!WORKFLOW_CODE_SCHEMA_KEYWORDS.has(key)) {
+            add(`${path}.${key}`, "unsupported_code_output_schema_keyword", `JSON Schema keyword '${key}' is not enforced by oxygen-js-v1.`);
+        }
+    }
+    if (schema.title !== undefined && typeof schema.title !== "string") {
+        add(`${path}.title`, "invalid_code_output_schema", "JSON Schema title must be a string.");
+    }
+    if (schema.description !== undefined && typeof schema.description !== "string") {
+        add(`${path}.description`, "invalid_code_output_schema", "JSON Schema description must be a string.");
+    }
+    if (schema.examples !== undefined
+        && (!Array.isArray(schema.examples) || schema.examples.some((entry) => !isJsonValue(entry)))) {
+        add(`${path}.examples`, "invalid_code_output_schema", "JSON Schema examples must be an array of JSON values.");
+    }
+    if (Object.hasOwn(schema, "default") && !isJsonValue(schema.default)) {
+        add(`${path}.default`, "invalid_code_output_schema", "JSON Schema default must be a JSON value.");
+    }
+    if (Object.hasOwn(schema, "const") && !isJsonValue(schema.const)) {
+        add(`${path}.const`, "invalid_code_output_schema", "JSON Schema const must be a JSON value.");
+    }
+    if (schema.enum !== undefined
+        && (!Array.isArray(schema.enum) || schema.enum.length === 0 || schema.enum.some((entry) => !isJsonValue(entry)))) {
+        add(`${path}.enum`, "invalid_code_output_schema", "JSON Schema enum must be a non-empty array of JSON values.");
+    }
+    const schemaTypes = workflowCodeSchemaTypes(schema.type, `${path}.type`, add);
+    const objectish = schemaTypes?.includes("object") === true
+        || schema.properties !== undefined
+        || schema.required !== undefined
+        || schema.additionalProperties !== undefined;
+    if (objectish && schema.additionalProperties !== false) {
+        add(`${path}.additionalProperties`, "open_code_output_schema", "Every object-shaped oxygen-js-v1 schema must set additionalProperties to false.");
+    }
+    if (objectish && schemaTypes && schemaTypes.length > 0 && !schemaTypes.includes("object")) {
+        add(`${path}.type`, "invalid_code_output_schema", "Object keywords require type 'object'.");
+    }
+    if (schema.anyOf !== undefined) {
+        const ignoredSiblings = keys.filter((key) => key !== "anyOf"
+            && !WORKFLOW_CODE_SCHEMA_ANNOTATIONS.has(key)
+            && key !== "const"
+            && key !== "enum");
+        if (ignoredSiblings.length > 0) {
+            add(path, "invalid_code_output_schema", `anyOf cannot be combined with ${ignoredSiblings.join(", ")} because oxygen-js-v1 would ignore those sibling constraints.`);
+        }
+        if (!Array.isArray(schema.anyOf) || schema.anyOf.length === 0) {
+            add(`${path}.anyOf`, "invalid_code_output_schema", "JSON Schema anyOf must be a non-empty array of schemas.");
+        }
+        else {
+            for (const [index, candidate] of schema.anyOf.entries()) {
+                if (!isRecord(candidate)) {
+                    add(`${path}.anyOf.${index}`, "invalid_code_output_schema", "Each anyOf entry must be a schema object.");
+                }
+                else {
+                    lintWorkflowCodeSchemaNode(candidate, `${path}.anyOf.${index}`, add, state, depth + 1);
+                }
+            }
+        }
+    }
+    const properties = schema.properties;
+    if (properties !== undefined) {
+        if (!isRecord(properties)) {
+            add(`${path}.properties`, "invalid_code_output_schema", "JSON Schema properties must be an object.");
+        }
+        else {
+            const propertyEntries = Object.entries(properties);
+            state.propertyCount += propertyEntries.length;
+            if (state.propertyCount > WORKFLOW_CODE_V1_MAX_SCHEMA_PROPERTIES && !state.propertyLimitReported) {
+                add(`${path}.properties`, "code_output_schema_too_large", `Typed code output_schema cannot declare more than ${WORKFLOW_CODE_V1_MAX_SCHEMA_PROPERTIES} named properties.`);
+                state.propertyLimitReported = true;
+            }
+            for (const [name, propertySchema] of propertyEntries) {
+                if (!isWorkflowCodeFieldName(name)) {
+                    add(`${path}.properties.${name}`, "invalid_code_output_field_name", `Typed code output field '${name}' must be a JavaScript identifier with no dots or brackets and cannot be a reserved object key.`);
+                }
+                if (!isRecord(propertySchema)) {
+                    add(`${path}.properties.${name}`, "invalid_code_output_schema", "Each property must be a schema object.");
+                }
+                else {
+                    lintWorkflowCodeSchemaNode(propertySchema, `${path}.properties.${name}`, add, state, depth + 1);
+                }
+            }
+        }
+    }
+    if (schema.required !== undefined) {
+        if (!Array.isArray(schema.required) || schema.required.some((name) => typeof name !== "string")) {
+            add(`${path}.required`, "invalid_code_output_schema", "JSON Schema required must be an array of property names.");
+        }
+        else {
+            const required = schema.required;
+            if (new Set(required).size !== required.length) {
+                add(`${path}.required`, "invalid_code_output_schema", "JSON Schema required property names must be unique.");
+            }
+            const declared = isRecord(properties) ? properties : {};
+            for (const name of required) {
+                if (!Object.hasOwn(declared, name)) {
+                    add(`${path}.required`, "invalid_code_output_schema", `Required property '${name}' needs a matching properties entry.`);
+                }
+            }
+        }
+    }
+    if (schema.items !== undefined) {
+        if (schemaTypes && schemaTypes.length > 0 && !schemaTypes.includes("array")) {
+            add(`${path}.type`, "invalid_code_output_schema", "JSON Schema items requires type 'array'.");
+        }
+        if (!isRecord(schema.items)) {
+            add(`${path}.items`, "invalid_code_output_schema", "JSON Schema items must be a schema object.");
+        }
+        else {
+            lintWorkflowCodeSchemaNode(schema.items, `${path}.items`, add, state, depth + 1);
+        }
+    }
+    state.ancestors.delete(schema);
+}
+function workflowCodeSchemaTypes(value, path, add) {
+    if (value === undefined)
+        return [];
+    const types = typeof value === "string"
+        ? [value]
+        : Array.isArray(value) && value.length > 0 && value.every((entry) => typeof entry === "string")
+            ? value
+            : null;
+    if (!types || types.some((type) => !WORKFLOW_CODE_JSON_TYPES.has(type))) {
+        add(path, "invalid_code_output_schema", "JSON Schema type must name only supported JSON value types.");
+        return null;
+    }
+    if (new Set(types).size !== types.length) {
+        add(path, "invalid_code_output_schema", "JSON Schema type arrays cannot contain duplicates.");
+    }
+    return types;
+}
+function isJsonValue(value, ancestors = new Set()) {
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return true;
+    if (typeof value === "number")
+        return Number.isFinite(value);
+    if (typeof value !== "object")
+        return false;
+    if (ancestors.has(value))
+        return false;
+    ancestors.add(value);
+    let valid;
+    if (Array.isArray(value)) {
+        valid = value.every((entry) => isJsonValue(entry, ancestors));
+    }
+    else {
+        const prototype = Object.getPrototypeOf(value);
+        valid = (prototype === Object.prototype || prototype === null)
+            && Object.values(value).every((entry) => isJsonValue(entry, ancestors));
+    }
+    ancestors.delete(value);
+    return valid;
+}
+function jsonByteLength(value) {
+    try {
+        const serialized = JSON.stringify(value);
+        return serialized === undefined ? null : Buffer.byteLength(serialized, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
 function lintToolNode(node, path, add, scope, options) {
     const hasPayloadSource = typeof node.payload_source === "string";
     if (!isNonEmptyString(node.tool)) {
@@ -670,6 +1065,11 @@ function lintGraphTopology(graph, add) {
                 + "Move the approval before the loop so one decision covers the whole batch.");
         });
     }
+    const codeSandboxUpperBound = workflowCodeSandboxInvocationUpperBound(graph);
+    if (codeSandboxUpperBound > WORKFLOW_CODE_V1_MAX_SANDBOX_INVOCATIONS_PER_RUN) {
+        add("$.nodes", "workflow_code_invocation_limit", `This graph can create more than ${WORKFLOW_CODE_V1_MAX_SANDBOX_INVOCATIONS_PER_RUN} Code sandboxes in one run after loops and retries. `
+            + "Reduce loop max_iterations, Code retries, or the number of Code nodes.");
+    }
     const reachable = reachableNodeIds(graph);
     graph.nodes.forEach((node, index) => {
         if (reachable.has(node.id))
@@ -800,6 +1200,8 @@ function validateScopePath(path, issuePath, add, scope) {
  * graph that a reachability rule would refuse.
  */
 function validateScopeNodeId(path, segments, issuePath, add, scope) {
+    if (scope.validateNodeIds === false)
+        return;
     const root = segments[0];
     if (root !== "steps" && root !== "loop")
         return; // `trigger` names no node.