@pi-unipi/unipi 3.0.0-alpha.2 → 3.0.0-alpha.21

package/packages/subagents/src/workflow-worker.ts

@@ -1,384 +0,0 @@
-/**
- * @pi-unipi/subagents — workflowScript sandbox worker
- *
- * Ported from pi-subagents src/workflows/scripted-workflow.ts (worker half).
- * Runs inside a Worker thread: validates the script (acorn AST — no nested
- * async helpers), compiles it into a vm context with { runs, state, emit,
- * console, Promise } globals, and bridges calls back to the host via
- * parentPort RPC. No filesystem, shell, or host globals reach the script.
- */
-
-import { parentPort, workerData } from "node:worker_threads";
-import { inspect } from "node:util";
-import { createRequire } from "node:module";
-import vm from "node:vm";
-
-const { parse } = createRequire(import.meta.url)(workerData.acornPath as string) as {
-  parse: (source: string, options: { ecmaVersion: string; sourceType: string }) => unknown;
-};
-
-type PendingEntry = { resolve: (value: unknown) => void; reject: (error: Error) => void };
-const pending = new Map<number, PendingEntry>();
-let nextCallId = 0;
-
-const runKeyPattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
-
-const NESTED_ASYNC_WORKFLOW_ERROR =
-  "workflowScript does not support nested async functions. Use top-level await, plain helper functions that return runs.run(...), or explicit Promise chains so workflows stay portable across Node and Bun.";
-const AST_SCALAR_KEYS = new Set(["type", "start", "end"]);
-
-function isAsyncFunctionNode(node: unknown): boolean {
-  return (
-    !!node &&
-    typeof node === "object" &&
-    (node as { async?: unknown }).async === true &&
-    ["FunctionDeclaration", "FunctionExpression", "ArrowFunctionExpression"].includes(
-      (node as { type?: unknown }).type as string,
-    )
-  );
-}
-
-function walkWorkflowAst(node: unknown, allowedAsyncFunction: unknown): void {
-  if (!node || typeof node !== "object") return;
-  if (Array.isArray(node)) {
-    for (const item of node) walkWorkflowAst(item, allowedAsyncFunction);
-    return;
-  }
-  if (node !== allowedAsyncFunction && isAsyncFunctionNode(node)) {
-    throw new Error(NESTED_ASYNC_WORKFLOW_ERROR);
-  }
-  for (const [key, child] of Object.entries(node as Record<string, unknown>)) {
-    if (AST_SCALAR_KEYS.has(key)) continue;
-    walkWorkflowAst(child, allowedAsyncFunction);
-  }
-}
-
-function workflowWrapperFunction(ast: unknown): unknown {
-  const wrapper = (
-    ast as { body?: Array<{ expression?: { callee?: unknown } }> }
-  ).body?.[0]?.expression?.callee;
-  if (
-    !wrapper ||
-    (wrapper as { type?: unknown }).type !== "ArrowFunctionExpression"
-  ) {
-    throw new Error("workflowScript wrapper parse invariant failed.");
-  }
-  return wrapper;
-}
-
-function assertPortableWorkflowScript(source: string): void {
-  const wrapped = "(async () => {\n" + source + "\n})()";
-  const ast = parse(wrapped, { ecmaVersion: "latest", sourceType: "script" });
-  const wrapper = workflowWrapperFunction(ast);
-  walkWorkflowAst(
-    (wrapper as { body?: unknown }).body,
-    wrapper,
-  );
-}
-
-let contextObjectPrototype: object | undefined;
-
-function assertJsonValue(value: unknown, path = "emit", seen = new Set<unknown>()): void {
-  if (value === null || typeof value === "string" || typeof value === "boolean") return;
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) throw new Error(path + " must contain only finite JSON numbers.");
-    return;
-  }
-  if (typeof value !== "object") throw new Error(path + " must be a JSON value; received " + typeof value + ".");
-  if (seen.has(value)) throw new Error(path + " must not contain cycles.");
-  seen.add(value);
-  if (Array.isArray(value)) {
-    for (let index = 0; index < value.length; index++) {
-      if (!Object.prototype.hasOwnProperty.call(value, index)) {
-        throw new Error(path + " must not contain sparse array entries.");
-      }
-      assertJsonValue(value[index], path + "[" + index + "]", seen);
-    }
-  } else {
-    const prototype = Object.getPrototypeOf(value);
-    if (
-      prototype !== null &&
-      prototype !== Object.prototype &&
-      prototype !== contextObjectPrototype
-    ) {
-      throw new Error(path + " must contain only plain JSON objects.");
-    }
-    if (Object.getOwnPropertySymbols(value).length > 0) {
-      throw new Error(path + " must not contain symbol keys.");
-    }
-    for (const [key, entry] of Object.entries(value)) {
-      assertJsonValue(entry, path + "." + key, seen);
-    }
-  }
-  seen.delete(value);
-}
-
-function stableRunJson(value: unknown): string {
-  if (Array.isArray(value)) return `[${value.map(stableRunJson).join(",")}]`;
-  if (value && typeof value === "object" && !Array.isArray(value)) {
-    const record = value as Record<string, unknown>;
-    return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableRunJson(record[key])}`).join(",")}}`;
-  }
-  return JSON.stringify(value) ?? "undefined";
-}
-
-function hostCall(method: string, args: unknown, observation?: { key?: string; operation?: string }): Promise<unknown> {
-  const callId = ++nextCallId;
-  const promise = new Promise((resolve, reject) => {
-    pending.set(callId, { resolve, reject });
-    parentPort!.postMessage({ type: "call", callId, method, args });
-  });
-  if (!observation) return promise;
-  // Await-observation: the script consuming .then/.catch/.finally marks the
-  // call observed so the host can enforce the unawaited-launch contract.
-  let observed = false;
-  const markObserved = () => {
-    if (observed) return;
-    observed = true;
-    parentPort!.postMessage({ type: "callObserved", callId, key: observation.key, operation: observation.operation });
-  };
-  return new Proxy(promise, {
-    get(target, prop, receiver) {
-      if (prop === "then" || prop === "catch" || prop === "finally") {
-        const fn = Reflect.get(target, prop, target) as (...a: unknown[]) => unknown;
-        return function (this: unknown, ...args: unknown[]): unknown {
-          markObserved();
-          return fn.apply(target, args);
-        };
-      }
-      const value = Reflect.get(target, prop, target);
-      return typeof value === "function" ? (value as (...a: unknown[]) => unknown).bind(target) : value;
-    },
-  }) as Promise<unknown>;
-}
-
-function validateRunCall(key: unknown, params: unknown, label: string, fingerprints: Map<string, string>): void {
-  if (typeof key !== "string" || !runKeyPattern.test(key)) throw new Error(label + " has an invalid key.");
-  if (!params || typeof params !== "object" || Array.isArray(params)) {
-    throw new Error(label + " requires a params object.");
-  }
-  const p = params as Record<string, unknown>;
-  for (const forbidden of ["action", "workflowScript", "tasks", "chain", "parallel", "concurrency", "chainDir"]) {
-    if (Object.prototype.hasOwnProperty.call(p, forbidden)) {
-      const hint = label === "runs.run" ? "; use runs.all(...) and JavaScript control flow for orchestration." : ".";
-      throw new Error(label + " accepts one child via { agent, task } and execution controls only" + hint);
-    }
-  }
-  if (Object.prototype.hasOwnProperty.call(p, "clarify")) {
-    throw new Error(label + " does not support clarify UI.");
-  }
-  if (p.worktree !== undefined && typeof p.worktree !== "boolean") {
-    throw new Error(label + " worktree must be true or false.");
-  }
-  if (p.resume !== undefined && p.agent !== undefined) {
-    throw new Error(label + " resume and agent are mutually exclusive.");
-  }
-  if (typeof p.resume === "string" && !p.resume.trim()) {
-    throw new Error(label + " resume must be a non-empty retained run id.");
-  }
-  if (p.resume !== undefined && (typeof p.task !== "string" || !(p.task as string).trim())) {
-    throw new Error(label + " resume requires a non-empty task follow-up.");
-  }
-  assertJsonValue(params, label + " params");
-  const fingerprint = stableRunJson(params);
-  const existing = fingerprints.get(key);
-  if (existing !== undefined && existing !== fingerprint) {
-    throw new Error("Duplicate workflow key '" + key + "' used with incompatible launch params.");
-  }
-  fingerprints.set(key, fingerprint);
-}
-
-const runs = Object.freeze({
-  run(key: unknown, params: unknown): Promise<unknown> {
-    validateRunCall(key, params, "runs.run", runFingerprints);
-    return hostCall("run", { key, params }, { key: key as string, operation: "run" });
-  },
-  all(items: unknown): Promise<unknown> {
-    if (!Array.isArray(items)) throw new Error("runs.all(items) requires an array.");
-    const fingerprints = new Map(runFingerprints);
-    const calls: Array<{ key: string; params: Record<string, unknown> }> = [];
-    for (let index = 0; index < items.length; index++) {
-      if (!Object.prototype.hasOwnProperty.call(items, index)) {
-        throw new Error("runs.all items must not contain sparse entries.");
-      }
-      const item = items[index];
-      if (!item || typeof item !== "object" || Array.isArray(item)) {
-        throw new Error("runs.all item " + index + " must be an object.");
-      }
-      const { key, ...params } = item as { key: unknown };
-      validateRunCall(key, params, "runs.all item " + index, fingerprints);
-      calls.push({ key: key as string, params: params as Record<string, unknown> });
-    }
-    runFingerprints = fingerprints;
-    return hostCall("all", { calls }, { operation: "all" });
-  },
-  steer(key: unknown, message: unknown, options: unknown = {}): Promise<unknown> {
-    if (typeof key !== "string" || !runKeyPattern.test(key)) throw new Error("runs.steer has an invalid key.");
-    if (typeof message !== "string" || !message.trim()) throw new Error("runs.steer message must be a non-empty string.");
-    if (!options || typeof options !== "object" || Array.isArray(options)) {
-      throw new Error("runs.steer options must be an object.");
-    }
-    const allowed = new Set(["mode", "index", "ackTimeoutMs"]);
-    for (const option of Object.keys(options as Record<string, unknown>)) {
-      if (!allowed.has(option)) throw new Error("runs.steer options contain unsupported field '" + option + "'.");
-    }
-    const o = options as Record<string, unknown>;
-    if (o.mode !== undefined && o.mode !== "steer" && o.mode !== "follow_up" && o.mode !== "auto") {
-      throw new Error("runs.steer mode must be 'steer', 'follow_up', or 'auto'.");
-    }
-    return hostCall("steer", { key, message: (message as string).trim(), options }, { key: key as string, operation: "steer" });
-  },
-  status(keyOrRunId: unknown): Promise<unknown> {
-    return hostCall("status", { keyOrRunId });
-  },
-  ref(result: unknown): string {
-    if (!result || typeof result !== "object") throw new Error("runs.ref(result) requires a run result object.");
-    const r = result as { key?: unknown; runId?: unknown };
-    const parts = ["run " + (r.key || "unknown")];
-    if (r.runId) parts.push("id=" + String(r.runId).slice(0, 8));
-    return "[" + parts.join("; ") + "]";
-  },
-  refs(results: unknown): string {
-    if (!Array.isArray(results)) throw new Error("runs.refs(results) requires an array.");
-    return results.map((result) => runs.ref(result)).join("\n");
-  },
-});
-
-let runFingerprints = new Map<string, string>();
-
-function validateStateKey(key: unknown): string {
-  if (typeof key !== "string" || !runKeyPattern.test(key)) {
-    throw new Error("state key must be 1-128 characters using letters, numbers, '.', '_' or '-', and start with a letter or number.");
-  }
-  return key;
-}
-
-const state = Object.freeze({
-  get(key: unknown): Promise<unknown> {
-    return hostCall("state.get", { key: validateStateKey(key) });
-  },
-  set(key: unknown, value: unknown): Promise<unknown> {
-    const validKey = validateStateKey(key);
-    assertJsonValue(value, "state.set('" + validKey + "') value");
-    return hostCall("state.set", { key: validKey, value });
-  },
-});
-
-const capturedConsole = Object.freeze(
-  Object.fromEntries(
-    (["log", "info", "warn", "error"] as const).map((level) => [
-      level,
-      (...args: unknown[]) => {
-        parentPort!.postMessage({
-          type: "console",
-          level,
-          text: args
-            .map((value) => (typeof value === "string" ? value : inspect(value, { depth: 4, breakLength: 120 })))
-            .join(" "),
-        });
-      },
-    ]),
-  ),
-);
-
-function formatWorkflowScriptError(error: unknown): string {
-  const message = error && typeof (error as Error).message === "string" ? (error as Error).message : String(error);
-  const stack = error && typeof (error as Error).stack === "string" ? (error as Error).stack : "";
-  if (!stack) return message;
-  return stack.includes(message) ? stack : message + "\n" + stack;
-}
-
-function isSyntaxError(error: unknown): boolean {
-  return error instanceof SyntaxError || (error as { name?: unknown } | null)?.name === "SyntaxError";
-}
-
-function formatWorkflowScriptSyntaxError(error: unknown): string {
-  const details = formatWorkflowScriptError(error);
-  return [
-    "workflowScript must be valid JavaScript.",
-    'If task text contains Markdown fences or backticks, use an array joined with "\\n" or escaped strings instead of a raw backtick template literal.',
-    "",
-    "Original SyntaxError:",
-    details,
-  ].join("\n");
-}
-
-parentPort!.on("message", (message: Record<string, unknown>) => {
-  if (message.type === "response") {
-    const entry = pending.get(message.callId as number);
-    if (!entry) return;
-    pending.delete(message.callId as number);
-    if (message.ok) entry.resolve(message.value);
-    else {
-      const error = new Error(String(message.error));
-      if (message.errorKind === "detached-child") {
-        (error as Error & { workflowErrorKind?: string }).workflowErrorKind = "detached-child";
-      }
-      entry.reject(error);
-    }
-    return;
-  }
-  if (message.type !== "start") return;
-
-  try {
-    const sandbox: Record<string, unknown> = {
-      runs,
-      emit(value: unknown): void {
-        assertJsonValue(value);
-        parentPort!.postMessage({ type: "emit", value });
-      },
-      console: capturedConsole,
-    };
-    if (message.stateEnabled) sandbox.state = state;
-    const context = vm.createContext(sandbox, { codeGeneration: { strings: false, wasm: false } });
-    contextObjectPrototype = vm.runInContext("Object.prototype", context) as object;
-
-    let compiled: vm.Script;
-    try {
-      assertPortableWorkflowScript(String(message.script));
-      compiled = new vm.Script("(async () => {\n" + String(message.script) + "\n})()", {
-        filename: "workflow-script.js",
-      });
-    } catch (error) {
-      parentPort!.postMessage({
-        type: "error",
-        error: isSyntaxError(error) ? formatWorkflowScriptSyntaxError(error) : formatWorkflowScriptError(error),
-      });
-      return;
-    }
-
-    compiled
-      .runInContext(context)
-      .then(
-        (value: unknown) => {
-          try {
-            // Ordinary statement-body semantics: a script without an explicit
-            // return resolves undefined, which serializes as null (reference test).
-            const normalized = value === undefined ? null : value;
-            assertJsonValue(normalized, "return");
-            parentPort!.postMessage({ type: "complete", value: normalized });
-          } catch (error) {
-            parentPort!.postMessage({
-              type: "error",
-              error:
-                "Workflow return could not be persisted: " +
-                (error instanceof Error ? error.message : String(error)),
-            });
-          }
-        },
-        (error: unknown) => {
-          const e = error as Error & { workflowErrorKind?: unknown };
-          parentPort!.postMessage({
-            type: "error",
-            error: formatWorkflowScriptError(error),
-            ...(e?.workflowErrorKind === "detached-child" ? { errorKind: "detached-child" } : {}),
-          });
-        },
-      )
-      .catch(() => {
-        // Post-message failures above are already best-effort; never crash the worker.
-      });
-  } catch (error) {
-    parentPort!.postMessage({ type: "error", error: formatWorkflowScriptError(error) });
-  }
-});