@sema-agent/core 1.279.0

package/dist/orchestration/workflow-sandbox-conformance.js

@@ -0,0 +1,220 @@
+import assert from "node:assert/strict";
+const META = "export const meta = { name: 'conformance', description: 'sandbox escape probes' }\n";
+const ESCAPE_BODIES = [
+    `return agent.constructor.constructor("return typeof process !== 'undefined' ? process : null")()`,
+    `return log.constructor.constructor("return typeof process !== 'undefined' ? process : null")()`,
+    `return budget.constructor.constructor("return typeof process !== 'undefined' ? process : null")()`,
+    `return ({}).constructor.constructor("return typeof process !== 'undefined' ? process : null")()`,
+    `return args.constructor.constructor("return typeof require !== 'undefined' ? require : null")()`,
+    `const r = await agent({ objective: 'x' }); return (r ?? {}).constructor.constructor("return typeof require !== 'undefined' ? require : null")()`,
+    `return (typeof process !== 'undefined' ? process : null)`,
+    `return (typeof require !== 'undefined' ? require : null)`,
+    `return (typeof globalThis !== 'undefined' && globalThis.process) ? globalThis.process : null`,
+];
+const ERROR_PATH_BODIES = [
+    `try { await agent({ objective: 'x' }); return null } catch (e) { return e.constructor.constructor("return typeof process !== 'undefined' ? process : null")() }`,
+    `try { await parallel([]); return null } catch (e) { return e.constructor.constructor("return typeof require !== 'undefined' ? require : null")() }`,
+    `try { await agent({}); return null } catch (e) { return (e && e.constructor && e.constructor.constructor) ? e.constructor.constructor("return (typeof globalThis !== 'undefined' && globalThis.process) ? globalThis.process : null")() : null }`,
+];
+const POLLUTION_BODIES = [
+    `return JSON.parse('{"__proto__":{"polluted":1}}')`,
+    `const o = {}; Reflect.defineProperty(o, "__proto__", { value: { polluted: 1 }, enumerable: true, configurable: true }); return o`,
+    `return { nested: JSON.parse('{"__proto__":{"polluted":1}}') }`,
+    `return { constructor: { prototype: { polluted: 1 } } }`,
+    `return [JSON.parse('{"__proto__":{"polluted":1}}')]`,
+];
+const SIGNAL_BODIES = [
+    `return (typeof signal !== 'undefined' && signal) ? signal.constructor.constructor("return typeof process !== 'undefined' ? process : null")() : null`,
+    `return (typeof input !== 'undefined' && input && input.signal) ? input.signal.constructor.constructor("return typeof process !== 'undefined' ? process : null")() : null`,
+    `try { return (typeof signal !== 'undefined' && signal) ? (signal.addEventListener ? signal.addEventListener.constructor("return typeof process !== 'undefined' ? process : null")() : null) : null } catch (e) { return null }`,
+];
+function benignPrimitives() {
+    return {
+        agent: async () => ({ status: "completed", result: "ok" }),
+        parallel: async (thunks) => Promise.all(thunks.map((t) => t())),
+        pipeline: async (items) => items,
+        phase: async (_title, body) => (body === undefined ? undefined : body()),
+        log: () => { },
+        budget: { total: null, spent: () => 0, remaining: () => Infinity },
+    };
+}
+function throwingPrimitives() {
+    const boom = () => {
+        throw new Error("host-side primitive failure");
+    };
+    return {
+        agent: async () => boom(),
+        parallel: async () => boom(),
+        pipeline: async () => boom(),
+        phase: async () => boom(),
+        log: () => { },
+        budget: { total: null, spent: () => 0, remaining: () => Infinity },
+    };
+}
+const DANGEROUS_OWN_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+function graphHasInjectedProtoKey(v, seen = new Set()) {
+    if (v == null || typeof v !== "object")
+        return false;
+    if (seen.has(v))
+        return false;
+    seen.add(v);
+    for (const k of Object.getOwnPropertyNames(v)) {
+        if (DANGEROUS_OWN_KEYS.has(k)) {
+            const val = Object.getOwnPropertyDescriptor(v, k)?.value;
+            if (val != null && typeof val === "object")
+                return true;
+        }
+    }
+    for (const k of Object.getOwnPropertyNames(v)) {
+        if (DANGEROUS_OWN_KEYS.has(k))
+            continue;
+        if (graphHasInjectedProtoKey(v[k], seen))
+            return true;
+    }
+    return false;
+}
+function looksLikeHostCapability(v) {
+    if (v == null)
+        return false;
+    if (typeof v === "function")
+        return true;
+    if (typeof v === "object") {
+        const o = v;
+        return "pid" in o || "env" in o || "version" in o || "mainModule" in o || "binding" in o;
+    }
+    return false;
+}
+export async function assertWorkflowPrimitivesWiring(runner) {
+    assert.equal(runner.safeForUntrustedScripts, true, "wiring conformance targets a HARD runner (safeForUntrustedScripts must be true)");
+    const hostSeen = { phaseCalls: [], scopedBodyRan: false, logs: [] };
+    const primitives = {
+        agent: async () => ({ status: "completed", result: "ok" }),
+        parallel: async (thunks) => Promise.all(thunks.map((t) => t())),
+        pipeline: async (items, ...stages) => {
+            let out = items;
+            for (const st of stages) {
+                out = await Promise.all(out.map((x, i) => st(x, x, i)));
+            }
+            return out;
+        },
+        phase: async (title, body) => {
+            hostSeen.phaseCalls.push({ title, hasBody: body !== undefined });
+            if (body === undefined)
+                return undefined;
+            const out = await body();
+            if (title === "wiring-scoped")
+                hostSeen.scopedBodyRan = true;
+            return out;
+        },
+        log: (message) => void hostSeen.logs.push(message),
+        budget: { total: 1000, spent: () => 25, remaining: () => 975 },
+    };
+    const scriptSource = META +
+        [
+            `const report = { typeofs: { agent: typeof agent, parallel: typeof parallel, pipeline: typeof pipeline, phase: typeof phase, log: typeof log, budgetRemaining: budget && typeof budget.remaining }, calls: {} }`,
+            `log('wiring-probe-log')`,
+            `report.calls.bareUndefined = (await phase('wiring-marker')) === undefined`,
+            `let scopedRan = false`,
+            `await phase('wiring-scoped', async () => { scopedRan = true })`,
+            `report.calls.scopedRan = scopedRan`,
+            `report.calls.budgetRemaining = budget.remaining()`,
+            `const par = await parallel([async () => 1, async () => 2])`,
+            `report.calls.parallelOk = Array.isArray(par) && par.length === 2`,
+            `const pipe = await pipeline([1, 2], async (x) => x)`,
+            `report.calls.pipelineOk = Array.isArray(pipe) && pipe.length === 2`,
+            `const a = await agent({ objective: 'wiring' })`,
+            `report.calls.agentOk = a && a.status === 'completed'`,
+            `return report`,
+        ].join("\n");
+    const out = await runner.run({ scriptSource, primitives, scriptArgs: {} });
+    const report = out.result;
+    assert.ok(report && report.typeofs && report.calls, "wiring probe returned no report — script body did not run");
+    for (const k of ["agent", "parallel", "pipeline", "phase", "log", "budgetRemaining"]) {
+        assert.equal(report.typeofs[k], "function", `primitive "${k}" is not a function INSIDE the isolate — injection table incomplete (the missing-injection failure mode)`);
+    }
+    assert.equal(report.calls.bareUndefined, true, "bare phase(title) must return undefined in-isolate");
+    assert.equal(report.calls.scopedRan, true, "scoped phase body did not run in-isolate");
+    assert.equal(report.calls.budgetRemaining, 975, "budget.remaining() is not bridged to the live host accessor");
+    assert.equal(report.calls.parallelOk, true, "parallel() thunks not executed");
+    assert.equal(report.calls.pipelineOk, true, "pipeline() stages not executed");
+    assert.equal(report.calls.agentOk, true, "agent() result not bridged back");
+    assert.deepEqual(hostSeen.phaseCalls.map((c) => `${c.title}:${c.hasBody ? "scoped" : "bare"}`), ["wiring-marker:bare", "wiring-scoped:scoped"], "phase() calls did not reach the HOST primitive (bridge severed — phases would record [])");
+    assert.equal(hostSeen.scopedBodyRan, true, "the scoped body's completion did not round-trip through the host phase()");
+    assert.deepEqual(hostSeen.logs, ["wiring-probe-log"], "log() did not reach the HOST primitive");
+}
+export async function assertWorkflowSandboxConformance(runner) {
+    assert.equal(runner.safeForUntrustedScripts, true, "conformance is only meaningful for a HARD runner (safeForUntrustedScripts must be true)");
+    for (const escBody of ESCAPE_BODIES) {
+        const scriptSource = META + escBody;
+        let result;
+        try {
+            const out = await runner.run({ scriptSource, primitives: benignPrimitives(), scriptArgs: { probe: true } });
+            result = out.result;
+        }
+        catch {
+            continue;
+        }
+        assert.equal(looksLikeHostCapability(result), false, `sandbox escape REACHED a host capability via: ${escBody}`);
+    }
+    for (const errBody of ERROR_PATH_BODIES) {
+        const scriptSource = META + errBody;
+        let result;
+        try {
+            const out = await runner.run({ scriptSource, primitives: throwingPrimitives(), scriptArgs: { probe: true } });
+            result = out.result;
+        }
+        catch {
+            continue;
+        }
+        assert.equal(looksLikeHostCapability(result), false, `error-path: a host-side primitive error leaked a host capability via: ${errBody}`);
+    }
+    for (const polBody of POLLUTION_BODIES) {
+        const scriptSource = META + polBody;
+        let result;
+        try {
+            const out = await runner.run({ scriptSource, primitives: benignPrimitives(), scriptArgs: { probe: true } });
+            result = out.result;
+        }
+        catch {
+            continue;
+        }
+        assert.equal(graphHasInjectedProtoKey(result), false, `prototype pollution: the marshalled result carries an injected __proto__/constructor/prototype own key via: ${polBody}`);
+    }
+    const hostSignal = new AbortController().signal;
+    for (const sigBody of SIGNAL_BODIES) {
+        const scriptSource = META + sigBody;
+        let result;
+        try {
+            const out = await runner.run({ scriptSource, primitives: benignPrimitives(), scriptArgs: { probe: true }, signal: hostSignal });
+            result = out.result;
+        }
+        catch {
+            continue;
+        }
+        assert.equal(looksLikeHostCapability(result), false, `signal-path: the host AbortSignal leaked a host capability via: ${sigBody}`);
+    }
+}
+const DETERMINISM_FORBIDDEN_BODIES = [
+    `try { return Date.now() } catch { return "threw" }`,
+    `try { return Math.random() } catch { return "threw" }`,
+    `try { return new Date().getTime() } catch { return "threw" }`,
+    `try { return new Date(0).constructor.now() } catch { return "threw" }`,
+];
+export async function assertWorkflowDeterminism(runner) {
+    for (const detBody of DETERMINISM_FORBIDDEN_BODIES) {
+        const scriptSource = META + detBody;
+        let threw = false;
+        let result;
+        try {
+            const out = await runner.run({ scriptSource, primitives: benignPrimitives(), scriptArgs: { probe: true } });
+            result = out.result;
+        }
+        catch {
+            threw = true;
+        }
+        assert.equal(threw || result === "threw", true, `determinism: ${detBody.trim().split("\n")[0]} did NOT throw — a clock/randomness read would silently bust resume`);
+    }
+    const out = await runner.run({ scriptSource: META + `return new Date(0).getTime()`, primitives: benignPrimitives(), scriptArgs: { probe: true } });
+    assert.equal(out.result, 0, "determinism: DATED construction new Date(0) must stay available");
+}
+//# sourceMappingURL=workflow-sandbox-conformance.js.map

package/dist/orchestration/workflow-sandbox-conformance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-sandbox-conformance.js","sourceRoot":"","sources":["../../src/orchestration/workflow-sandbox-conformance.ts"],"names":[],"mappings":"AAWA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AAGxC,MAAM,IAAI,GAAG,qFAAqF,CAAC;AAKnG,MAAM,aAAa,GAAa;IAE9B,kGAAkG;IAElG,gGAAgG;IAEhG,mGAAmG;IAEnG,iGAAiG;IAEjG,iGAAiG;IAEjG,iJAAiJ;IAEjJ,0DAA0D;IAC1D,0DAA0D;IAC1D,8FAA8F;CAC/F,CAAC;AAUF,MAAM,iBAAiB,GAAa;IAClC,iKAAiK;IACjK,oJAAoJ;IACpJ,kPAAkP;CACnP,CAAC;AAUF,MAAM,gBAAgB,GAAa;IACjC,mDAAmD;IACnD,kIAAkI;IAClI,+DAA+D;IAC/D,wDAAwD;IACxD,qDAAqD;CACtD,CAAC;AAUF,MAAM,aAAa,GAAa;IAC9B,sJAAsJ;IACtJ,0KAA0K;IAC1K,gOAAgO;CACjO,CAAC;AAEF,SAAS,gBAAgB;IACvB,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC1D,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAE,MAAwC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAClG,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK;QAChC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,IAA+B,EAAE,CAAC;QACpG,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC;QACb,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE;KACnE,CAAC;AACJ,CAAC;AAID,SAAS,kBAAkB;IACzB,MAAM,IAAI,GAAG,GAAU,EAAE;QACvB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC,CAAC;IACF,OAAO;QACL,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE;QACzB,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE;QAC5B,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE;QAC5B,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE;QACzB,GAAG,EAAE,GAAG,EAAE,GAAE,CAAC;QACb,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE;KACnE,CAAC;AACJ,CAAC;AAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAK9E,SAAS,wBAAwB,CAAC,CAAU,EAAE,OAAO,IAAI,GAAG,EAAW;IACrE,IAAI,CAAC,IAAI,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC;YACzD,IAAI,GAAG,IAAI,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QACxC,IAAI,wBAAwB,CAAE,CAA6B,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAID,SAAS,uBAAuB,CAAC,CAAU;IACzC,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,OAAO,CAAC,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,SAAS,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,IAAI,SAAS,IAAI,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,MAA4B;IAC/E,MAAM,CAAC,KAAK,CACV,MAAM,CAAC,uBAAuB,EAC9B,IAAI,EACJ,iFAAiF,CAClF,CAAC;IACF,MAAM,QAAQ,GAAG,EAAE,UAAU,EAAE,EAAgD,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,EAAc,EAAE,CAAC;IAC9H,MAAM,UAAU,GAAuB;QACrC,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC1D,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAE,MAAwC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAClG,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,EAAE;YACnC,IAAI,GAAG,GAAG,KAAkB,CAAC;YAC7B,KAAK,MAAM,EAAE,IAAI,MAA2E,EAAE,CAAC;gBAC7F,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC,CAAC;YACjE,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YACzC,MAAM,GAAG,GAAG,MAAO,IAA+B,EAAE,CAAC;YACrD,IAAI,KAAK,KAAK,eAAe;gBAAE,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAC;YAC7D,OAAO,GAAG,CAAC;QACb,CAAC;QACD,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;QAClD,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE;KAC/D,CAAC;IACF,MAAM,YAAY,GAChB,IAAI;QACJ;YACE,gNAAgN;YAChN,yBAAyB;YACzB,2EAA2E;YAC3E,uBAAuB;YACvB,gEAAgE;YAChE,oCAAoC;YACpC,mDAAmD;YACnD,4DAA4D;YAC5D,kEAAkE;YAClE,qDAAqD;YACrD,oEAAoE;YACpE,gDAAgD;YAChD,sDAAsD;YACtD,eAAe;SAChB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,GAAG,CAAC,MAGlB,CAAC;IACF,MAAM,CAAC,EAAE,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,2DAA2D,CAAC,CAAC;IAEjH,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACrF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC,0GAA0G,CAAC,CAAC;IACzK,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,oDAAoD,CAAC,CAAC;IACrG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,0CAA0C,CAAC,CAAC;IACvF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,EAAE,6DAA6D,CAAC,CAAC;IAC/G,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,gCAAgC,CAAC,CAAC;IAC9E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,gCAAgC,CAAC,CAAC;IAC9E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,iCAAiC,CAAC,CAAC;IAG5E,MAAM,CAAC,SAAS,CACd,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAC7E,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,EAC9C,0FAA0F,CAC3F,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,EAAE,0EAA0E,CAAC,CAAC;IACvH,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,kBAAkB,CAAC,EAAE,wCAAwC,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,MAA4B;IACjF,MAAM,CAAC,KAAK,CACV,MAAM,CAAC,uBAAuB,EAC9B,IAAI,EACJ,yFAAyF,CAC1F,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACpC,MAAM,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC;QACpC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5G,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,iDAAiD,OAAO,EAAE,CAAC,CAAC;IACnH,CAAC;IAID,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,MAAM,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC;QACpC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9G,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,yEAAyE,OAAO,EAAE,CAAC,CAAC;IAC3I,CAAC;IAID,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC;QACpC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5G,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,CAAC,KAAK,CACV,wBAAwB,CAAC,MAAM,CAAC,EAChC,KAAK,EACL,+GAA+G,OAAO,EAAE,CACzH,CAAC;IACJ,CAAC;IAID,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC;IAChD,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACpC,MAAM,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC;QACpC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAChI,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,mEAAmE,OAAO,EAAE,CAAC,CAAC;IACrI,CAAC;AACH,CAAC;AAGD,MAAM,4BAA4B,GAAG;IACnC,oDAAoD;IACpD,uDAAuD;IACvD,8DAA8D;IAC9D,uEAAuE;CACxE,CAAC;AASF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,MAA4B;IAC1E,KAAK,MAAM,OAAO,IAAI,4BAA4B,EAAE,CAAC;QACnD,MAAM,YAAY,GAAG,IAAI,GAAG,OAAO,CAAC;QACpC,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5G,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,MAAM,KAAK,OAAO,EAAE,IAAI,EAAE,gBAAgB,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,qEAAqE,CAAC,CAAC;IACtK,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,IAAI,GAAG,8BAA8B,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACnJ,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,iEAAiE,CAAC,CAAC;AACjG,CAAC"}

package/dist/orchestration/workflow-script-runner.d.ts

@@ -0,0 +1,39 @@
+import type { RunnerDeps, TaskSpec } from "../core/types.js";
+export declare function isSelfOrchestrationActive(spec: TaskSpec, deps: RunnerDeps): boolean;
+export declare function workflowsCapability(deps: RunnerDeps): boolean;
+export declare function selfOrchestrationFailClosedReason(spec: TaskSpec, deps: RunnerDeps): string | null;
+export interface WorkflowMeta {
+    name: string;
+    description: string;
+    phases?: Array<{
+        title: string;
+        detail?: string;
+        model?: string;
+    }>;
+    whenToUse?: string;
+}
+export interface WorkflowPrimitives {
+    agent(spec: unknown, opts?: unknown): Promise<unknown>;
+    parallel(thunks: unknown[]): Promise<unknown[]>;
+    pipeline(items: unknown[], ...stages: unknown[]): Promise<unknown[]>;
+    phase(title: string, body: unknown): Promise<unknown>;
+    log(message: string): void;
+    budget: {
+        total: number | null;
+        spent(): number;
+        remaining(): number;
+    };
+}
+export interface WorkflowScriptRunner {
+    readonly safeForUntrustedScripts: boolean;
+    run(input: {
+        scriptSource: string;
+        primitives: WorkflowPrimitives;
+        scriptArgs: unknown;
+        signal?: AbortSignal;
+    }): Promise<{
+        result: unknown;
+        meta: WorkflowMeta;
+    }>;
+}
+//# sourceMappingURL=workflow-script-runner.d.ts.map

package/dist/orchestration/workflow-script-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-script-runner.d.ts","sourceRoot":"","sources":["../../src/orchestration/workflow-script-runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAS7D,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAEnF;AAcD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAK7D;AAQD,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAcjG;AAqBD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IAGpB,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAaD,MAAM,WAAW,kBAAkB;IAGjC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEvD,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAEhD,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAErE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtD,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAM3B,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,IAAI,MAAM,CAAC;QAAC,SAAS,IAAI,MAAM,CAAA;KAAE,CAAC;CACxE;AAOD,MAAM,WAAW,oBAAoB;IAUnC,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;IAC1C,GAAG,CAAC,KAAK,EAAE;QACT,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,kBAAkB,CAAC;QAC/B,UAAU,EAAE,OAAO,CAAC;QAQpB,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,YAAY,CAAA;KAAE,CAAC,CAAC;CACtD"}

package/dist/orchestration/workflow-script-runner.js

@@ -0,0 +1,23 @@
+export function isSelfOrchestrationActive(spec, deps) {
+    return spec.selfOrchestration === true && workflowsCapability(deps);
+}
+export function workflowsCapability(deps) {
+    return (deps.workflowScriptRunner?.safeForUntrustedScripts === true &&
+        deps.workflowGovernanceBaseline !== undefined);
+}
+export function selfOrchestrationFailClosedReason(spec, deps) {
+    if (spec.selfOrchestration !== true)
+        return null;
+    if (isSelfOrchestrationActive(spec, deps))
+        return null;
+    const missing = [];
+    if (deps.workflowScriptRunner?.safeForUntrustedScripts !== true) {
+        missing.push("a hard WorkflowScriptRunner (RunnerDeps.workflowScriptRunner.safeForUntrustedScripts === true)");
+    }
+    if (deps.workflowGovernanceBaseline === undefined) {
+        missing.push("a governance baseline (RunnerDeps.workflowGovernanceBaseline)");
+    }
+    return (`self-orchestration (TaskSpec.selfOrchestration) requires ${missing.join(" and ")}; it is DISABLED for ` +
+        `this task (fail-closed — the run_workflow tool is not mounted and the orchestration prompt is not injected).`);
+}
+//# sourceMappingURL=workflow-script-runner.js.map

package/dist/orchestration/workflow-script-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-script-runner.js","sourceRoot":"","sources":["../../src/orchestration/workflow-script-runner.ts"],"names":[],"mappings":"AASA,MAAM,UAAU,yBAAyB,CAAC,IAAc,EAAE,IAAgB;IACxE,OAAO,IAAI,CAAC,iBAAiB,KAAK,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC;AACtE,CAAC;AAcD,MAAM,UAAU,mBAAmB,CAAC,IAAgB;IAClD,OAAO,CACL,IAAI,CAAC,oBAAoB,EAAE,uBAAuB,KAAK,IAAI;QAC3D,IAAI,CAAC,0BAA0B,KAAK,SAAS,CAC9C,CAAC;AACJ,CAAC;AAQD,MAAM,UAAU,iCAAiC,CAAC,IAAc,EAAE,IAAgB;IAChF,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,CAAC,oBAAoB,EAAE,uBAAuB,KAAK,IAAI,EAAE,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,gGAAgG,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,IAAI,CAAC,0BAA0B,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,CACL,4DAA4D,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB;QACxG,8GAA8G,CAC/G,CAAC;AACJ,CAAC"}

package/dist/orchestration/workflow-script-store.d.ts

@@ -0,0 +1,20 @@
+export interface NamedWorkflowResolution {
+    script: string;
+    defaultArgs?: unknown;
+    stringArgKey?: string;
+}
+export interface NamedWorkflowListing {
+    name: string;
+    description?: string;
+    whenToUse?: string;
+}
+export interface WorkflowScriptStore {
+    persist(runId: string, script: string): Promise<string> | string;
+    load(scriptPath: string): Promise<string> | string;
+    resolveName?(name: string): Promise<string | NamedWorkflowResolution | undefined> | string | NamedWorkflowResolution | undefined;
+    list?(): NamedWorkflowListing[] | Promise<NamedWorkflowListing[]>;
+}
+export declare function mergeWorkflowArgs(callArgs: unknown, defaultArgs: unknown): unknown;
+export declare function normalizeStringArg(callArgs: unknown, defaultArgs: unknown, key?: string): unknown;
+export declare function createFileWorkflowScriptStore(dir: string): WorkflowScriptStore;
+//# sourceMappingURL=workflow-script-store.d.ts.map

package/dist/orchestration/workflow-script-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-script-store.d.ts","sourceRoot":"","sources":["../../src/orchestration/workflow-script-store.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IAIf,WAAW,CAAC,EAAE,OAAO,CAAC;IAStB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAOD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAGlC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAGjE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAKnD,WAAW,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAAC;IAQjI,IAAI,CAAC,IAAI,oBAAoB,EAAE,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;CACnE;AAiBD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,GAAG,OAAO,CAsBlF;AAoBD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,SAAU,GAAG,OAAO,CAGlG;AAYD,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAyC9E"}

package/dist/orchestration/workflow-script-store.js

@@ -0,0 +1,73 @@
+import { mkdirSync, readFileSync, writeFileSync, existsSync } from "node:fs";
+import { join, resolve, sep } from "node:path";
+function isPlainObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+export function mergeWorkflowArgs(callArgs, defaultArgs) {
+    const cloneDefaults = (v) => {
+        try {
+            return structuredClone(v);
+        }
+        catch {
+            return v;
+        }
+    };
+    if (callArgs === undefined)
+        return cloneDefaults(defaultArgs);
+    if (defaultArgs === undefined)
+        return callArgs;
+    if (isPlainObject(callArgs) && isPlainObject(defaultArgs)) {
+        return { ...cloneDefaults(defaultArgs), ...callArgs };
+    }
+    return callArgs;
+}
+export function normalizeStringArg(callArgs, defaultArgs, key = "topic") {
+    if (typeof callArgs === "string" && isPlainObject(defaultArgs))
+        return { [key]: callArgs };
+    return callArgs;
+}
+function safeFileStem(id) {
+    return /^[A-Za-z0-9._-]{1,120}$/.test(id) && !id.startsWith(".") ? id : undefined;
+}
+export function createFileWorkflowScriptStore(dir) {
+    const root = resolve(dir);
+    return {
+        persist(runId, script) {
+            const stem = safeFileStem(runId);
+            if (stem === undefined)
+                throw new Error(`workflow script store: unsafe runId for a filename: ${JSON.stringify(runId)}`);
+            mkdirSync(root, { recursive: true, mode: 0o700 });
+            const path = join(root, `${stem}.js`);
+            writeFileSync(path, script, { encoding: "utf-8", mode: 0o600 });
+            return path;
+        },
+        load(scriptPath) {
+            const full = resolve(scriptPath);
+            if (full !== root && !full.startsWith(root + sep)) {
+                throw new Error(`workflow script store: scriptPath is outside the script store (${root})`);
+            }
+            return readFileSync(full, "utf-8");
+        },
+        resolveName(name) {
+            const stem = safeFileStem(name);
+            if (stem === undefined)
+                return undefined;
+            const path = join(root, `${stem}.js`);
+            if (!existsSync(path))
+                return undefined;
+            const script = readFileSync(path, "utf-8");
+            const argsPath = join(root, `${stem}.args.json`);
+            if (!existsSync(argsPath))
+                return script;
+            let defaultArgs;
+            try {
+                defaultArgs = JSON.parse(readFileSync(argsPath, "utf-8"));
+            }
+            catch (err) {
+                throw new Error(`workflow script store: invalid defaultArgs JSON in ${stem}.args.json: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            return { script, defaultArgs };
+        },
+    };
+}
+//# sourceMappingURL=workflow-script-store.js.map

package/dist/orchestration/workflow-script-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-script-store.js","sourceRoot":"","sources":["../../src/orchestration/workflow-script-store.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AA0D/C,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAYD,MAAM,UAAU,iBAAiB,CAAC,QAAiB,EAAE,WAAoB;IAMvE,MAAM,aAAa,GAAG,CAAC,CAAU,EAAW,EAAE;QAC5C,IAAI,CAAC;YACH,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC,WAAW,CAAC,CAAC;IAC9D,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAI1D,OAAO,EAAE,GAAI,aAAa,CAAC,WAAW,CAA6B,EAAE,GAAG,QAAQ,EAAE,CAAC;IACrF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAoBD,MAAM,UAAU,kBAAkB,CAAC,QAAiB,EAAE,WAAoB,EAAE,GAAG,GAAG,OAAO;IACvF,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,aAAa,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC3F,OAAO,QAAQ,CAAC;AAClB,CAAC;AAID,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACpF,CAAC;AAMD,MAAM,UAAU,6BAA6B,CAAC,GAAW;IACvD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO;QACL,OAAO,CAAC,KAAK,EAAE,MAAM;YACnB,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAExH,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC;YACtC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,UAAU;YAGb,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;YACjC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,kEAAkE,IAAI,GAAG,CAAC,CAAC;YAC7F,CAAC;YACD,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;QACD,WAAW,CAAC,IAAI;YACd,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC;YACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACxC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAG3C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,YAAY,CAAC,CAAC;YACjD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO,MAAM,CAAC;YACzC,IAAI,WAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBAEb,MAAM,IAAI,KAAK,CAAC,sDAAsD,IAAI,eAAe,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/I,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACjC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/orchestration/workflow-size-guideline.d.ts

@@ -0,0 +1,10 @@
+export type WorkflowSizeGuideline = "small" | "medium" | "large" | "unrestricted";
+export declare const WORKFLOW_SIZE_GUIDELINES: readonly WorkflowSizeGuideline[];
+export declare const WORKFLOW_SIZE_GUIDELINE_AGENT_CAPS: Readonly<Record<"small" | "medium" | "large", number>>;
+export declare function normalizeWorkflowSizeGuideline(value: unknown): WorkflowSizeGuideline;
+export declare function workflowSizeGuidelineAgentCap(g: WorkflowSizeGuideline): number | undefined;
+export declare function describeWorkflowSizeGuideline(g: WorkflowSizeGuideline): string;
+export declare function formatWorkflowSizeGuidelineLabel(g: WorkflowSizeGuideline): string;
+export declare function workflowSizeGuidelineSection(value: unknown): string;
+export declare function workflowSizeGuidelineChangeNotice(g: WorkflowSizeGuideline): string;
+//# sourceMappingURL=workflow-size-guideline.d.ts.map

package/dist/orchestration/workflow-size-guideline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-size-guideline.d.ts","sourceRoot":"","sources":["../../src/orchestration/workflow-size-guideline.ts"],"names":[],"mappings":"AAyBA,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,cAAc,CAAC;AAGlF,eAAO,MAAM,wBAAwB,EAAE,SAAS,qBAAqB,EAAiD,CAAC;AAGvH,eAAO,MAAM,kCAAkC,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,GAAG,QAAQ,GAAG,OAAO,EAAE,MAAM,CAAC,CAIrG,CAAC;AAGF,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,CAGpF;AAID,wBAAgB,6BAA6B,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,GAAG,SAAS,CAE1F;AAGD,wBAAgB,6BAA6B,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAG9E;AASD,wBAAgB,gCAAgC,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAGjF;AAQD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKnE;AAID,wBAAgB,iCAAiC,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAIlF"}

package/dist/orchestration/workflow-size-guideline.js

@@ -0,0 +1,38 @@
+export const WORKFLOW_SIZE_GUIDELINES = ["unrestricted", "small", "medium", "large"];
+export const WORKFLOW_SIZE_GUIDELINE_AGENT_CAPS = {
+    small: 5,
+    medium: 15,
+    large: 50,
+};
+export function normalizeWorkflowSizeGuideline(value) {
+    if (value === "small" || value === "medium" || value === "large")
+        return value;
+    return "unrestricted";
+}
+export function workflowSizeGuidelineAgentCap(g) {
+    return g === "small" || g === "medium" || g === "large" ? WORKFLOW_SIZE_GUIDELINE_AGENT_CAPS[g] : undefined;
+}
+export function describeWorkflowSizeGuideline(g) {
+    if (!(g in WORKFLOW_SIZE_GUIDELINE_AGENT_CAPS))
+        return g;
+    return `${g} — keep workflows under ${WORKFLOW_SIZE_GUIDELINE_AGENT_CAPS[g]} agents`;
+}
+function guidelineNotHardLimit() {
+    return "This is a guideline, not a hard limit — follow it unless the user's prompt calls for a different scale.";
+}
+export function formatWorkflowSizeGuidelineLabel(g) {
+    const cap = workflowSizeGuidelineAgentCap(g);
+    return cap === undefined ? g : `${g} (aim for <${cap} agents)`;
+}
+export function workflowSizeGuidelineSection(value) {
+    const g = normalizeWorkflowSizeGuideline(value);
+    if (g !== "unrestricted")
+        return `\n\nThe user has configured a workflow size guideline in /config: ${describeWorkflowSizeGuideline(g)}. ${guidelineNotHardLimit()}`;
+    return "";
+}
+export function workflowSizeGuidelineChangeNotice(g) {
+    if (g === "unrestricted")
+        return "The user removed their workflow size guideline in /config — workflow size is unrestricted again.";
+    return `The user changed their workflow size guideline in /config: ${describeWorkflowSizeGuideline(g)}. ${guidelineNotHardLimit()}`;
+}
+//# sourceMappingURL=workflow-size-guideline.js.map

package/dist/orchestration/workflow-size-guideline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-size-guideline.js","sourceRoot":"","sources":["../../src/orchestration/workflow-size-guideline.ts"],"names":[],"mappings":"AA4BA,MAAM,CAAC,MAAM,wBAAwB,GAAqC,CAAC,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAGvH,MAAM,CAAC,MAAM,kCAAkC,GAA2D;IACxG,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,EAAE;IACV,KAAK,EAAE,EAAE;CACV,CAAC;AAGF,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC3D,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC/E,OAAO,cAAc,CAAC;AACxB,CAAC;AAID,MAAM,UAAU,6BAA6B,CAAC,CAAwB;IACpE,OAAO,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9G,CAAC;AAGD,MAAM,UAAU,6BAA6B,CAAC,CAAwB;IACpE,IAAI,CAAC,CAAC,CAAC,IAAI,kCAAkC,CAAC;QAAE,OAAO,CAAC,CAAC;IACzD,OAAO,GAAG,CAAC,2BAA2B,kCAAkC,CAAC,CAAiC,CAAC,SAAS,CAAC;AACvH,CAAC;AAGD,SAAS,qBAAqB;IAC5B,OAAO,yGAAyG,CAAC;AACnH,CAAC;AAID,MAAM,UAAU,gCAAgC,CAAC,CAAwB;IACvE,MAAM,GAAG,GAAG,6BAA6B,CAAC,CAAC,CAAC,CAAC;IAC7C,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,GAAG,UAAU,CAAC;AACjE,CAAC;AAQD,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,MAAM,CAAC,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,cAAc;QACtB,OAAO,qEAAqE,6BAA6B,CAAC,CAAC,CAAC,KAAK,qBAAqB,EAAE,EAAE,CAAC;IAC7I,OAAO,EAAE,CAAC;AACZ,CAAC;AAID,MAAM,UAAU,iCAAiC,CAAC,CAAwB;IACxE,IAAI,CAAC,KAAK,cAAc;QACtB,OAAO,kGAAkG,CAAC;IAC5G,OAAO,8DAA8D,6BAA6B,CAAC,CAAC,CAAC,KAAK,qBAAqB,EAAE,EAAE,CAAC;AACtI,CAAC"}