@qduc/term2 0.22.0 → 0.23.0

package/dist/services/sandboxed-code-host/host-types.d.ts

@@ -10,6 +10,8 @@ export type HostErrorCode = 'syntax_error' | 'runtime_error' | 'timeout' | 'dead
 export interface HostError {
     code: HostErrorCode;
     message: string;
+    /** Host-owned distinction that cannot safely be recovered from prose. */
+    detail?: 'unhandled_nested_failure' | 'unknown_tool' | 'invalid_tool_output';
 }
 export type HostResult = {
     ok: true;
@@ -60,6 +62,7 @@ export type CapabilityOutcome = {
     kind: 'fail';
     code: HostErrorCode;
     message: string;
+    detail?: HostError['detail'];
 };
 export interface CapabilityLimits {
     /** Total calls one run may admit for this capability. */
@@ -82,6 +85,8 @@ export interface CapabilityHandler<Prepared = unknown> {
     invoke(prepared: Prepared, context: CapabilityCallContext): Promise<CapabilityOutcome>;
     /** Fires when a call is admitted, before it runs. Used for run bookkeeping. */
     onAdmitted?(prepared: Prepared, context: CapabilityCallContext): void;
+    /** Fires when an admitted call cannot settle before an abort or worker failure. */
+    onAborted?(prepared: Prepared, context: CapabilityCallContext, reason: string): void;
     /**
      * Nested-approval wait started. The host keys its waiting-set by
      * {@link CapabilityCallContext.requestId}. Missing {@link onResumed} is work.
@@ -117,6 +122,8 @@ export interface HostLimits {
 }
 export interface HostRunInput {
     code: string;
+    /** Optional JSON object exposed to code as the realm-local global `inputs`. */
+    inputData?: Record<string, JsonValue>;
     capabilities: Record<string, CapabilityHandler<any>>;
     limits: HostLimits;
     signal?: AbortSignal;
@@ -125,7 +132,11 @@ export interface HostRunInput {
     /** When set, code that returns nothing completes with `null` rather than failing. */
     allowVoidOutput?: boolean;
     onConsole?: (values: JsonValue[]) => void;
-    /** Test seam; defaults to a worker built from `capabilities`. */
+    /**
+     * Trusted test seam; defaults to the confined worker built from
+     * `capabilities`. A custom worker is outside the WORKER_TEMPLATE realm
+     * invariant and has no production caller.
+     */
     workerFactory?: (code: string, syncTimeoutMs: number) => import('node:worker_threads').Worker;
 }
 export interface SandboxedCodeHost {

package/dist/services/sandboxed-code-host/host-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-types.d.ts","sourceRoot":"","sources":["../../../source/services/sandboxed-code-host/host-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6CAA6C,CAAC;AAE7E,YAAY,EAAE,SAAS,EAAE,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,eAAe,GACf,SAAS,GACT,UAAU,GACV,WAAW,GACX,gBAAgB,GAChB,mBAAmB,GACnB,qBAAqB,GACrB,gBAAgB,GAChB,gBAAgB,CAAC;AAErB,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,UAAU,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,SAAS,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAEjH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,WAAW,CAAC;AAErD,2DAA2D;AAC3D,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEpE,iEAAiE;AACjE,MAAM,WAAW,qBAAqB;IACpC,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB,CAAC,QAAQ,GAAG,OAAO;IACnD,sDAAsD;IACtD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,MAAM,EAAE,gBAAgB,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,QAAQ,GAAG,iBAAiB,CAAC,GAAG,QAAQ,GAAG,iBAAiB,CAAC;IAChH,6EAA6E;IAC7E,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACvF,+EAA+E;IAC/E,UAAU,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACtE;;;OAGG;IACH,SAAS,CAAC,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACjD,+DAA+D;IAC/D,SAAS,CAAC,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACjD;;;;;OAKG;IACH,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IAChD;;;;;;;OAOG;IACH,UAAU,CAAC,CAAC,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,QAAQ,EAAE,QAAQ,GAAG,iBAAiB,CAAC;CACpG;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,IAAI,CAAC;IAC1C,iEAAiE;IACjE,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,qBAAqB,EAAE,MAAM,CAAC;CAC/F;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC/C;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAM9E"}
+{"version":3,"file":"host-types.d.ts","sourceRoot":"","sources":["../../../source/services/sandboxed-code-host/host-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6CAA6C,CAAC;AAE7E,YAAY,EAAE,SAAS,EAAE,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,eAAe,GACf,SAAS,GACT,UAAU,GACV,WAAW,GACX,gBAAgB,GAChB,mBAAmB,GACnB,qBAAqB,GACrB,gBAAgB,GAChB,gBAAgB,CAAC;AAErB,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,MAAM,CAAC,EAAE,0BAA0B,GAAG,cAAc,GAAG,qBAAqB,CAAC;CAC9E;AAED,MAAM,MAAM,UAAU,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,SAAS,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAEjH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,WAAW,CAAC;AAErD,2DAA2D;AAC3D,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEpE,iEAAiE;AACjE,MAAM,WAAW,qBAAqB;IACpC,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAA;CAAE,CAAC;AAEzF,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB,CAAC,QAAQ,GAAG,OAAO;IACnD,sDAAsD;IACtD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,MAAM,EAAE,gBAAgB,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,QAAQ,GAAG,iBAAiB,CAAC,GAAG,QAAQ,GAAG,iBAAiB,CAAC;IAChH,6EAA6E;IAC7E,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACvF,+EAA+E;IAC/E,UAAU,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACtE,mFAAmF;IACnF,SAAS,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACrF;;;OAGG;IACH,SAAS,CAAC,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACjD,+DAA+D;IAC/D,SAAS,CAAC,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACjD;;;;;OAKG;IACH,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IAChD;;;;;;;OAOG;IACH,UAAU,CAAC,CAAC,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,QAAQ,EAAE,QAAQ,GAAG,iBAAiB,CAAC;CACpG;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,IAAI,CAAC;IAC1C;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,qBAAqB,EAAE,MAAM,CAAC;CAC/F;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC/C;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAM9E"}

package/dist/services/sandboxed-code-host/host-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"host-types.js","sourceRoot":"","sources":["../../../source/services/sandboxed-code-host/host-types.ts"],"names":[],"mappings":"AAyIA,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAE,KAA2B,CAAC,IAAI,KAAK,QAAQ,IAAK,KAA2B,CAAC,IAAI,KAAK,MAAM,CAAC,CACjG,CAAC;AACJ,CAAC"}
+{"version":3,"file":"host-types.js","sourceRoot":"","sources":["../../../source/services/sandboxed-code-host/host-types.ts"],"names":[],"mappings":"AAmJA,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAE,KAA2B,CAAC,IAAI,KAAK,QAAQ,IAAK,KAA2B,CAAC,IAAI,KAAK,MAAM,CAAC,CACjG,CAAC;AACJ,CAAC"}

package/dist/services/sandboxed-code-host/host-worker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-worker.d.ts","sourceRoot":"","sources":["../../../source/services/sandboxed-code-host/host-worker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAwVzD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,GAAG,MAAM,CAEhF"}
+{"version":3,"file":"host-worker.d.ts","sourceRoot":"","sources":["../../../source/services/sandboxed-code-host/host-worker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AA2czD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,GAAG,MAAM,CAEhF"}

package/dist/services/sandboxed-code-host/host-worker.js

@@ -4,8 +4,8 @@
  * generated, which is what keeps the sandbox auditable now that the source is
  * built rather than written.
  *
- * The context exposes only the bound capabilities and `console`; Node's worker
- * globals never enter the vm context.
+ * The context exposes only the bound capabilities, `console`, and optional
+ * realm-created JSON `inputs`; Node's worker globals never enter the vm context.
  */
 const WORKER_TEMPLATE = String.raw `
 const { parentPort, workerData } = require('node:worker_threads');
@@ -137,6 +137,9 @@ const context = vm.createContext(Object.create(null), { codeGeneration: { string
 const inflight = new Set();
 let resultsConsumed = 0;
 let finished = false;
+let closeRequested = false;
+let admissionClosed = false;
+let settlementScheduled = false;
 let lastWasIdle = false;
 let idleScheduled = false;
 function emitBusy() {
@@ -162,6 +165,16 @@ function finishSend(type, payload) {
   finished = true;
   send(type, payload);
 }
+function emitSettledIfReady() {
+  if (!closeRequested || inflight.size !== 0 || finished || settlementScheduled) return;
+  settlementScheduled = true;
+  queueMicrotask(() => {
+    settlementScheduled = false;
+    if (!closeRequested || inflight.size !== 0 || finished) return;
+    const unhandled = getUnhandled();
+    finishSend('workflow.settled', { unhandled });
+  });
+}
 // This is the only host-realm callable made available during context setup.
 // Its prototype is severed, it returns no host value, and it is deleted from
 // the global object before user code runs. The context-created wrappers retain
@@ -178,6 +191,7 @@ const bridge = (type, payload) => {
     return;
   }
   if (typeof type === 'string' && type.endsWith('.run')) {
+    if (admissionClosed) return;
     emitBusy();
     if (payload && payload.requestId !== undefined) inflight.add(String(payload.requestId));
     parentPort.postMessage({ type, ...(payload || {}) });
@@ -189,9 +203,11 @@ const bridge = (type, payload) => {
 Object.setPrototypeOf(bridge, null);
 context.__bridge = bridge;
 context.__capabilities = JSON.stringify(capabilities);
+if (workerData.inputDataJson !== undefined) context.__inputData = workerData.inputDataJson;
 function installContextBindings() {
   const bridge = globalThis.__bridge;
   const capabilityDefinitions = JSON.parse(globalThis.__capabilities);
+  const inputData = globalThis.__inputData === undefined ? undefined : JSON.parse(globalThis.__inputData);
   function json(value, ancestors = new Set()) {
     if (value === null || typeof value === 'string' || typeof value === 'boolean') return true;
     if (typeof value === 'number') return Number.isFinite(value);
@@ -204,36 +220,105 @@ function installContextBindings() {
   }
   delete globalThis.__bridge;
   delete globalThis.__capabilities;
+  delete globalThis.__inputData;
+  if (inputData !== undefined) {
+    Object.defineProperty(globalThis, 'inputs', {
+      value: inputData,
+      configurable: true,
+      enumerable: true,
+      writable: true,
+    });
+  }
   let sequence = 0;
   const pending = new Map();
+  const nestedStates = new Map();
+  function trackedPromise(promise, state) {
+    // Keep the worker alive for unawaited calls without letting Node report an
+    // unhandled rejection. Script-supplied rejection handlers are tracked
+    // separately so an unobserved nested failure remains diagnosable.
+    promise.catch(() => {});
+    const tracked = {
+      then(onFulfilled, onRejected) {
+        if (typeof onRejected === 'function') state.observed = true;
+        return trackedPromise(promise.then(onFulfilled, onRejected), state);
+      },
+      catch(onRejected) {
+        if (typeof onRejected === 'function') state.observed = true;
+        return trackedPromise(promise.catch(onRejected), state);
+      },
+      finally(onFinally) {
+        return trackedPromise(promise.finally(onFinally), state);
+      },
+    };
+    return tracked;
+  }
+  // Structured clone can carry host-realm objects such as Date, Map, and Error.
+  // Capability arguments must not use that wider transport: normalize them in
+  // this realm first, so the bridge only ever sees JSON-created plain data.
+  function serializeTransport(value) {
+    let encoded;
+    try {
+      encoded = JSON.stringify(value);
+    } catch (_) {
+      throw new TypeError('Capability arguments must be JSON-serializable');
+    }
+    if (encoded === undefined) return null;
+    try {
+      return JSON.parse(encoded);
+    } catch (_) {
+      throw new TypeError('Capability arguments must be JSON-serializable');
+    }
+  }
   function call(name, payload) {
     const requestId = String(++sequence);
-    return new Promise((resolve) => {
-      pending.set(requestId, resolve);
-      bridge(name + '.run', Object.assign({ requestId }, payload));
+    const state = { observed: false, rejected: false, message: '' };
+    nestedStates.set(requestId, state);
+    const promise = new Promise((resolve) => {
+      pending.set(requestId, { resolve, state });
+      bridge(name + '.run', Object.assign({ requestId }, serializeTransport(payload)));
     });
+    return { promise: trackedPromise(promise, state), state };
   }
   function factoryBinding(name) {
-    return (config) => Object.freeze({ run(input) { return call(name, { config, input }); } });
+    return (config) => Object.freeze({ run(input) { return call(name, { config, input }).promise; } });
   }
   function namespaceBinding(name, members) {
     const namespace = Object.create(null);
-    for (const member of members) namespace[member] = (params) => call(name, { member, params }).then((response) => {
-      // Namespace members speak an { ok, result | error } envelope so a refused or
-      // failed call is catchable inside the script instead of a silent value.
-      if (!response || typeof response !== 'object') return response;
-      // Naming the tool here is what lets a model tell which call of a fan-out
-      // failed: the underlying message often does not (e.g. 'rg: regex parse error').
-      if (response.ok === false) throw new Error('tools.' + member + ' failed: ' + String(response.error));
-      return response.result;
-    });
+    for (const member of members) {
+      const callable = (params) => {
+        const callState = call(name, { member, params });
+        return callState.promise.then((response) => {
+          // Namespace members speak an { ok, result | error } envelope so a refused or
+          // failed call is catchable inside the script instead of a silent value.
+          if (!response || typeof response !== 'object') return response;
+          // Naming the tool here is what lets a model tell which call of a fan-out
+          // failed: the underlying message often does not (e.g. 'rg: regex parse error').
+          if (response.ok === false) {
+            callState.state.rejected = true;
+            callState.state.message = 'tools.' + member + ' failed: ' + String(response.error);
+            throw new Error(callState.state.message);
+          }
+          return response.result;
+        });
+      };
+      // Assignment gives the magic __proto__ member setter prototype-mutating
+      // semantics. Define an own data property for every member instead.
+      Object.defineProperty(namespace, member, {
+        value: callable,
+        configurable: true,
+        enumerable: true,
+        writable: true,
+      });
+    }
     // Unknown members explain themselves instead of surfacing as
     // 'tools.x is not a function', which names neither the problem nor the fix.
     const guarded = new Proxy(namespace, {
       get(target, prop) {
         if (prop in target) return target[prop];
         if (typeof prop === 'string') {
-          throw new Error('Unknown tool "' + prop + '". Available: ' + members.join(', '));
+           const unknown = new Error('Unknown tool "' + prop + '". Available: ' + members.join(', '));
+           unknown.code = 'unknown_tool';
+           throw unknown;
         }
         return undefined;
       },
@@ -241,25 +326,42 @@ function installContextBindings() {
     return Object.freeze(guarded);
   }
   for (const capability of capabilityDefinitions) {
-    globalThis[capability.name] = capability.kind === 'namespace'
-      ? namespaceBinding(capability.name, capability.members)
-      : factoryBinding(capability.name);
+    // Assignment gives the magic global __proto__ name prototype-mutating
+    // semantics. Define an own data property for every capability name.
+    Object.defineProperty(globalThis, capability.name, {
+      value: capability.kind === 'namespace' ? namespaceBinding(capability.name, capability.members) : factoryBinding(capability.name),
+      configurable: true,
+      enumerable: true,
+      writable: true,
+    });
   }
   // A transport guard only: the host independently validates console data and
   // applies the cumulative budget before forwarding it to observers.
   globalThis.console = Object.freeze({ log: (...values) => {
     if (!values.every(value => json(value))) return;
-    bridge('console.log', { values });
+    try {
+      bridge('console.log', { values: serializeTransport(values) });
+    } catch (_) {}
   } });
-  return (requestId, result) => {
-    const resolve = pending.get(requestId);
-    pending.delete(requestId);
-    if (!resolve) return;
-    const encoded = JSON.stringify(result);
-    resolve(encoded === undefined ? null : JSON.parse(encoded));
+  return {
+    resolve(requestId, result) {
+      const entry = pending.get(requestId);
+      pending.delete(requestId);
+      if (!entry) return;
+      const encoded = JSON.stringify(result);
+      entry.resolve(encoded === undefined ? null : JSON.parse(encoded));
+    },
+    getUnhandled() {
+      return Array.from(nestedStates).filter(([, state]) => state.rejected && !state.observed).map(([requestId, state]) => ({
+        requestId,
+        message: state.message || 'nested call failed',
+      }));
+    },
   };
 }
-const resolveResponse = vm.runInContext('(' + installContextBindings.toString() + ')()', context);
+const responseHandlers = vm.runInContext('(' + installContextBindings.toString() + ')()', context);
+const resolveResponse = responseHandlers.resolve;
+const getUnhandled = responseHandlers.getUnhandled;
 function firstScriptFrame(stack) {
   var stackLines = stack ? String(stack).split('\n') : [];
   for (var i = 0; i < stackLines.length; i++) {
@@ -289,7 +391,7 @@ function runtimeErrorDetail(code, err) {
   return located ? '\n\nAt script ' + located : '';
 }
 
-if (typeof resolveResponse !== 'function') throw new Error('Failed to install sandbox bindings');
+if (typeof resolveResponse !== 'function' || typeof getUnhandled !== 'function') throw new Error('Failed to install sandbox bindings');
 parentPort.on('message', (message) => {
   if (typeof message.type === 'string' && message.type.endsWith('.result')) {
     resultsConsumed++;
@@ -297,6 +399,12 @@ parentPort.on('message', (message) => {
     resolveResponse(message.requestId, message.result);
     emitBusy();
     scheduleIdle();
+    emitSettledIfReady();
+    return;
+  }
+  if (message.type === 'workflow.close') {
+    closeRequested = true;
+    emitSettledIfReady();
   }
 });
 (async () => {
@@ -304,7 +412,8 @@ parentPort.on('message', (message) => {
     const script = new vm.Script('(async () => { "use strict";\n' + workerData.code + '\n})()', { filename: 'workflow.js' });
     const output = await script.runInContext(context, { timeout: workerData.syncTimeoutMs });
     if (output === undefined && workerData.allowVoidOutput) {
-      finishSend('workflow.complete', { output: null, voidOutput: true });
+      admissionClosed = true;
+      send('workflow.body-complete', { output: null, voidOutput: true });
       return;
     }
     const serialized = serializeJson(output);
@@ -319,7 +428,8 @@ parentPort.on('message', (message) => {
           resultsConsumed +
           ' nested tool calls already completed — inspect state before retrying.',
       );
-    finishSend('workflow.complete', { output: serialized.value });
+    admissionClosed = true;
+    send('workflow.body-complete', { output: serialized.value });
   } catch (err) {
     // Compile errors are raised by the host-realm 'new vm.Script(...)' above, so
     // 'err instanceof SyntaxError' is meaningful only here. A SyntaxError thrown
@@ -335,7 +445,12 @@ parentPort.on('message', (message) => {
       var at = runtimeErrorDetail(workerData.code, err);
       if (at) reported.message = reported.message + at;
     }
-    finishSend('workflow.error', { error: reported, syntax: err instanceof SyntaxError });
+    admissionClosed = true;
+     send('workflow.body-error', {
+       error: reported,
+       syntax: err instanceof SyntaxError,
+       ...(err && err.code === 'unknown_tool' ? { detail: 'unknown_tool' } : {}),
+     });
   }
 })();
 `;

package/dist/services/sandboxed-code-host/host-worker.js.map

@@ -1 +1 @@
-{"version":3,"file":"host-worker.js","sourceRoot":"","sources":["../../../source/services/sandboxed-code-host/host-worker.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2UjC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAsC;IACtE,OAAO,eAAe,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrF,CAAC"}
+{"version":3,"file":"host-worker.js","sourceRoot":"","sources":["../../../source/services/sandboxed-code-host/host-worker.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8bjC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAsC;IACtE,OAAO,eAAe,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;AACrF,CAAC"}

package/dist/services/sandboxed-code-host/sandbox.d.ts

@@ -1,13 +1,18 @@
 import { Worker } from 'node:worker_threads';
-import type { CapabilityBinding } from './host-types.js';
+import type { CapabilityBinding, JsonValue } from './host-types.js';
 export interface SandboxOptions {
     syncTimeoutMs: number;
     maxConsoleBytes?: number;
     subject?: string;
     /** When set, a script that returns nothing completes with `null` instead of failing. */
     allowVoidOutput?: boolean;
+    inputDataJson?: string;
     capabilities: readonly CapabilityBinding[];
 }
+export declare function serializeSandboxInputData(inputData: Record<string, JsonValue>): {
+    json: string;
+    bytes: number;
+};
 /**
  * Creates a fresh, disposable worker. The worker's application-facing context is
  * built inside the worker template and contains no host objects.

package/dist/services/sandboxed-code-host/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../source/services/sandboxed-code-host/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC5C;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,MAAM,CAY3E"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../source/services/sandboxed-code-host/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEpE,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC5C;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAG/G;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,MAAM,CAa3E"}

package/dist/services/sandboxed-code-host/sandbox.js

@@ -1,6 +1,10 @@
 import { Worker } from 'node:worker_threads';
 import { workerBootstrapExecArgv } from '../../utils/worker-bootstrap.js';
 import { buildWorkerSource } from './host-worker.js';
+export function serializeSandboxInputData(inputData) {
+    const json = JSON.stringify(inputData);
+    return { json, bytes: Buffer.byteLength(json, 'utf8') };
+}
 /**
  * Creates a fresh, disposable worker. The worker's application-facing context is
  * built inside the worker template and contains no host objects.
@@ -15,6 +19,7 @@ export function createSandbox(code, options) {
             maxConsoleBytes: options.maxConsoleBytes,
             subject: options.subject,
             allowVoidOutput: options.allowVoidOutput,
+            inputDataJson: options.inputDataJson,
         },
     });
 }

package/dist/services/sandboxed-code-host/sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../source/services/sandboxed-code-host/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAYrD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAuB;IACjE,OAAO,IAAI,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;QACzD,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,uBAAuB,EAAE;QACnC,UAAU,EAAE;YACV,IAAI;YACJ,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,eAAe,EAAE,OAAO,CAAC,eAAe;SACzC;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../source/services/sandboxed-code-host/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAarD,MAAM,UAAU,yBAAyB,CAAC,SAAoC;IAC5E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACvC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAuB;IACjE,OAAO,IAAI,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;QACzD,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,uBAAuB,EAAE;QACnC,UAAU,EAAE;YACV,IAAI;YACJ,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,aAAa,EAAE,OAAO,CAAC,aAAa;SACrC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/services/sandboxed-code-host/sandboxed-code-host.d.ts

@@ -6,9 +6,9 @@ import { type HostError, type HostResult, type HostRunInput, type SandboxedCodeH
  * The host owns everything that is the same for every caller: worker lifecycle,
  * the wall-clock deadline, parent cancellation, code and output byte budgets,
  * console capture, per-capability admission control and concurrency permits.
- * What the code can *reach* is entirely in the capabilities it is handed —
- * `run_agent_workflow` passes `agent`, `run_code` passes `tools` — so the two
- * tools differ only in that object.
+ * What the code can *reach* is explicit in the input: `run_agent_workflow`
+ * passes the `agent` capability, while `run_code` passes `tools` plus a
+ * realm-created JSON `inputs` object.
  */
 export declare class SandboxedCodeHostImpl implements SandboxedCodeHost {
     run(input: HostRunInput): Promise<HostResult>;

package/dist/services/sandboxed-code-host/sandboxed-code-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandboxed-code-host.d.ts","sourceRoot":"","sources":["../../../source/services/sandboxed-code-host/sandboxed-code-host.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,SAAS,EAEd,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACvB,MAAM,iBAAiB,CAAC;AAUzB;;;;;;;;;;GAUG;AACH,qBAAa,qBAAsB,YAAW,iBAAiB;IACvD,GAAG,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAuQlD;CACF;AA4DD,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC"}
+{"version":3,"file":"sandboxed-code-host.d.ts","sourceRoot":"","sources":["../../../source/services/sandboxed-code-host/sandboxed-code-host.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,SAAS,EAEd,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACvB,MAAM,iBAAiB,CAAC;AAUzB;;;;;;;;;;GAUG;AACH,qBAAa,qBAAsB,YAAW,iBAAiB;IACvD,GAAG,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CA4alD;CACF;AA4DD,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC"}