@signalridge/pi-workflows 1.7.4 → 1.8.0

package/src/journal.ts

@@ -537,6 +537,8 @@ function parseTerminalResult(raw: unknown, runId: string): RecoveryTerminalResul
 }
 
 function parseRunRecovery(raw: Record<string, unknown>, run: ScriptRun, timestamp: number): RunRecoveryEvent {
+  if (run.status === "completed" || run.nonResumable || run.terminalIntent === "stop")
+    throw new Error("cannot recover a completed or non-resumable workflow run");
   if (raw.status !== "interrupted") throw new Error("run recovery status is invalid");
   if (typeof raw.branchGeneration !== "number" || !Number.isInteger(raw.branchGeneration) || raw.branchGeneration < 0) {
     throw new Error("run recovery branchGeneration is invalid");
@@ -1140,6 +1142,8 @@ export function applyRecoveryEvent(run: ScriptRun, event: RunRecoveryEvent | Att
   if (event.kind === "run_recovery") {
     run.status = "interrupted";
     run.terminalIntent = undefined;
+    run.error = undefined;
+    run.finalResult = undefined;
     for (const rotation of event.rotations) applyRecoveryRotation(run, rotation);
     applyRecoveryTerminalResults(run, event.terminalResults ?? []);
   } else {
@@ -1218,6 +1222,7 @@ function applyJournalEvent(runs: Map<string, ScriptRun>, event: JournalEvent): v
       break;
     case "workflow_transition":
       run.status = event.status;
+      if (event.status === "running") run.error = undefined;
       if (event.error !== undefined) run.error = event.error;
       if (event.finalResult !== undefined) run.finalResult = structuredClone(event.finalResult);
       if (event.terminalIntent !== undefined) run.terminalIntent = event.terminalIntent;

package/src/runtime.ts

@@ -3,7 +3,8 @@
  *
  * A workflow is a raw JavaScript module. The runtime parses it under an acorn
  * gate (deterministic literal `export const meta` first, no nondeterministic
- * builtins), then executes the body inside a `node:vm` realm with a bounded set
+ * builtins), then executes the body/callbacks in an owned Node helper's vm realm
+ * with validated IPC proxies to the parent-owned bounded set
  * of orchestration globals (`agent`, `parallel`, `pipeline`, `workflow`,
  * quality/control helpers, `phase`, `log`, `args`, `cwd`, restricted
  * `process`, `budget`). The vm is a determinism guardrail, not a security
@@ -20,7 +21,6 @@
 
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash } from "node:crypto";
-import vm from "node:vm";
 import type { ManagedRoutingPolicy } from "@signalridge/pi-subagents-protocol";
 import { agentTierPolicyIdentity, isManagedAgentTier } from "@signalridge/pi-subagents-protocol";
 import { parse } from "acorn";
@@ -40,6 +40,7 @@ import {
   type WorkflowStrength,
   type WorkflowStrengthTable,
 } from "./strengths.js";
+import { executeOwnedVm } from "./vm-helper.js";
 
 // ── Meta contract ────────────────────────────────────────────────────────────
 
@@ -895,7 +896,8 @@ export function normalizeMaxAgents(value: unknown): number {
 export function normalizeAgentTimeout(value: unknown): number | null {
   if (value === null) return null;
   if (value === undefined) return DEFAULT_AGENT_TIMEOUT_MS;
-  if (typeof value !== "number" || !Number.isFinite(value) || value < 1) return DEFAULT_AGENT_TIMEOUT_MS;
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 1 || value > 2_147_483_647)
+    return DEFAULT_AGENT_TIMEOUT_MS;
   return Math.floor(value);
 }
 
@@ -1237,6 +1239,12 @@ export async function runWorkflow<T = unknown>(
   options: WorkflowRunOptions = {},
 ): Promise<WorkflowRunResult<T>> {
   const started = Date.now();
+  // Each frame owns cancellation, even when a parent catches a nested failure.
+  const frameController = new AbortController();
+  options = {
+    ...options,
+    signal: options.signal ? AbortSignal.any([options.signal, frameController.signal]) : frameController.signal,
+  };
   const { meta, body } = parseWorkflowScript(script);
   const maxAgents = normalizeMaxAgents(options.maxAgents ?? MAX_AGENTS_PER_RUN);
   const agentTimeoutMs = normalizeAgentTimeout(options.agentTimeoutMs);
@@ -1616,7 +1624,8 @@ export async function runWorkflow<T = unknown>(
       throwIfAborted();
       if (batch?.cancelled) throw agentLimitError();
 
-      const timeout = agentOptions.timeoutMs !== undefined ? agentOptions.timeoutMs : agentTimeoutMs;
+      const timeout =
+        agentOptions.timeoutMs !== undefined ? normalizeAgentTimeout(agentOptions.timeoutMs) : agentTimeoutMs;
       const retryAttempts = normalizeAgentRetries(agentOptions.retries ?? options.agentRetries ?? 0);
       const maxAttempts = retryAttempts + 1;
 
@@ -1709,7 +1718,10 @@ export async function runWorkflow<T = unknown>(
               agentType: agentOptions.agentType,
               isolation: resolvedIsolation,
               toolset: options.toolset ?? agentOptions.toolset,
-              excludeTools: options.excludeTools ?? agentOptions.excludeTools,
+              excludeTools:
+                options.excludeTools === undefined && agentOptions.excludeTools === undefined
+                  ? undefined
+                  : [...new Set([...(options.excludeTools ?? []), ...(agentOptions.excludeTools ?? [])])],
               runId,
               callIndex,
               callHash,
@@ -2220,15 +2232,20 @@ export async function runWorkflow<T = unknown>(
         if (code === WorkflowErrorCode.TOKEN_BUDGET_EXHAUSTED || code === WorkflowErrorCode.AGENT_LIMIT_EXCEEDED) break;
         throw error;
       }
-      const fresh = (Array.isArray(items) ? items : []).filter((x) => x != null && !seen.has(key(x)));
+      const fresh: Array<{ item: unknown; key: string }> = [];
+      for (const item of Array.isArray(items) ? items : []) {
+        if (item == null) continue;
+        const identity = await key(item);
+        if (!seen.has(identity)) fresh.push({ item, key: identity });
+      }
       if (!fresh.length) {
         dry++;
         continue;
       }
       dry = 0;
-      for (const x of fresh) {
-        seen.add(key(x));
-        all.push(x);
+      for (const entry of fresh) {
+        seen.add(entry.key);
+        all.push(entry.item);
       }
     }
     return all;
@@ -2265,7 +2282,7 @@ export async function runWorkflow<T = unknown>(
     for (let i = 0; i < attempts; i++) {
       throwIfAborted();
       last = await thunk(i);
-      const accepted = !opts.until || opts.until(last);
+      const accepted = !opts.until || (await opts.until(last));
       emitRuntimeEvent({ type: "control-attempt", helper: "retry", attempt: i + 1, accepted });
       if (accepted) return last;
     }
@@ -2397,18 +2414,20 @@ export async function runWorkflow<T = unknown>(
     );
   }
 
-  const context = vm.createContext({
-    ...runtimeBindings,
-    // Object/Array/JSON/Math/Date/Promise/Set/Map/etc. come from the vm realm
-    // itself — we deliberately do NOT inject host built-ins, whose
-    // .constructor would be the host Function (a determinism-guard bypass).
-    // Math/Date are neutered in-realm by DETERMINISM_PRELUDE below.
-  });
-
   const wrapped = `${DETERMINISM_PRELUDE}\n(async () => {\n${body}\n})()`;
   try {
-    const result = await new vm.Script(wrapped, { filename: `${meta.name || "workflow"}.js` }).runInContext(context, {
-      timeout: MAX_SCRIPT_SYNC_MS,
+    const result = await executeOwnedVm({
+      script: wrapped,
+      filename: `${meta.name || "workflow"}.js`,
+      args: options.args,
+      cwd: baseCwd,
+      bindings: { ...runtimeBindings },
+      total: budget.total,
+      spent: budget.spent,
+      cancel: () => frameController.abort(),
+      signal: options.signal
+        ? AbortSignal.any([options.signal, shared.runFatalController.signal])
+        : shared.runFatalController.signal,
     });
     try {
       const serialized = JSON.stringify(result);
@@ -2439,6 +2458,7 @@ export async function runWorkflow<T = unknown>(
     // reaching here does NOT seal anything (the parent may still catch
     // workflow()'s rejection). Idempotent: aborting an already-aborted
     // controller is a no-op.
+    frameController.abort();
     if (isTopLevelRun) shared.runFatalController.abort();
     throw error;
   } finally {

package/src/safe-text.ts

@@ -1,42 +1,11 @@
-/**
- * Terminal-safety for untrusted text rendered by the `/workflows` navigator.
- *
- * Task results, task errors, and run errors originate in child agent sessions, so they are
- * attacker-influenced from this package's point of view. Duplicated rather than imported:
- * extensions must not depend on another extension's source (see docs/package-boundaries.md).
- */
+import { sanitizeDisplayText as encodeDisplayText } from "@signalridge/pi-ui";
 
-/** Control, escape-introducing, and bidi-override code points a terminal would act on. */
-function isUnsafeTerminalCodePoint(codePoint: number): boolean {
-  return (
-    codePoint <= 0x1f ||
-    (codePoint >= 0x7f && codePoint <= 0x9f) ||
-    codePoint === 0x061c ||
-    codePoint === 0x200e ||
-    codePoint === 0x200f ||
-    (codePoint >= 0x202a && codePoint <= 0x202e) ||
-    (codePoint >= 0x2066 && codePoint <= 0x2069)
-  );
-}
-
-/**
- * Replace every code point a terminal could interpret as control input with a space.
- * Neutralizing the introducer (ESC, and the 8-bit C1 forms such as `0x9b` CSI) is what makes
- * the remainder of a sequence inert payload text rather than a command.
- */
+/** Display-only encoding. Never apply it to stored workflow values or journals. */
 export function sanitizeTerminalText(value: string): string {
-  return [...value]
-    .map((character) => (isUnsafeTerminalCodePoint(character.codePointAt(0) ?? 0) ? " " : character))
-    .join("");
+  return encodeDisplayText(value);
 }
 
-/**
- * Single-line, bounded rendering of untrusted text.
- *
- * Sanitizing strictly before truncating is load-bearing: slicing first can cut through an
- * escape sequence and leave a dangling introducer that swallows whatever the terminal draws
- * next. Slicing by code point additionally avoids splitting a surrogate pair.
- */
+/** Retained public helper: single-line, code-point-bounded display copy. */
 export function sanitizeDisplayText(value: string, maximumLength: number): string {
   if (maximumLength < 1) return "";
   const safe = sanitizeTerminalText(value).replace(/\s+/gu, " ").trim();

package/src/ui.ts

@@ -1,6 +1,6 @@
 import type { ExtensionCommandContext, Theme } from "@earendil-works/pi-coding-agent";
 import { DynamicBorder } from "@earendil-works/pi-coding-agent";
-import { Container, type SelectItem, SelectList, Text } from "@earendil-works/pi-tui";
+import { Key, matchesKey, type SelectItem, SelectList, Text } from "@earendil-works/pi-tui";
 import type { WorkflowEngine } from "./engine.js";
 import type { ScriptRun } from "./journal.js";
 import { sanitizeDisplayText } from "./safe-text.js";
@@ -62,6 +62,15 @@ export function formatWorkflowRunLabel(run: ScriptRun): string {
   return `${name} · ${run.status}${phases} · ${calls} calls · ${elapsed(Math.max(0, (isTerminal(run.status) ? run.updatedAt : Date.now()) - run.startedAt))}`;
 }
 
+function resultText(value: unknown): string {
+  if (typeof value === "string") return value;
+  try {
+    return JSON.stringify(value) ?? "(no preview)";
+  } catch {
+    return "(unavailable preview)";
+  }
+}
+
 export function formatWorkflowDetail(engine: WorkflowEngine, runId: string): string {
   const state = engine.getState(runId);
   if (!state) return "Workflow run is no longer available.";
@@ -89,7 +98,7 @@ export function formatWorkflowDetail(engine: WorkflowEngine, runId: string): str
       const parts = [`  ${status.padEnd(11)} call ${sanitizeDisplayText(nodeId, MAX_ID_CHARS)}${agent}${compact}`];
       if (result?.error) parts.push(`    error: ${sanitizeDisplayText(result.error, MAX_RESULT_CHARS)}`);
       if (result?.result !== undefined && result.status === "completed") {
-        parts.push(`    result: ${sanitizeDisplayText(String(result.result), MAX_RESULT_CHARS)}`);
+        parts.push(`    result: ${sanitizeDisplayText(resultText(result.result), MAX_RESULT_CHARS)}`);
       }
       return parts.join("\n");
     });
@@ -145,12 +154,13 @@ async function selectList<T>(
   items: SelectItem[],
   renderExtra: (theme: Pick<Theme, "fg">) => string,
 ): Promise<T | undefined> {
-  if (ctx.mode !== "tui") return undefined;
-  return ctx.ui.custom<T | undefined>((_tui, theme, _keybindings, done) => {
-    const container = new Container();
-    container.addChild(new DynamicBorder((s: string) => theme.fg("borderAccent", s)));
-    container.addChild(new Text(theme.fg("accent", theme.bold(title)), 1, 0));
-    container.addChild(new Text(theme.fg("dim", renderExtra(theme)), 1, 0));
+  if (ctx.mode !== "tui" || !ctx.hasUI) return undefined;
+  return ctx.ui.custom<T | undefined>((tui, theme, _keybindings, done) => {
+    const border = new DynamicBorder((s: string) => theme.fg("borderAccent", s));
+    const heading = new Text(theme.fg("accent", theme.bold(title)), 1, 0);
+    const detail = new Text(theme.fg("dim", renderExtra(theme)), 1, 0);
+    let offset = 0;
+    let pageSize = 1;
     const list = new SelectList(items, Math.min(12, Math.max(1, items.length)), {
       selectedPrefix: (text) => theme.fg("accent", text),
       selectedText: (text) => theme.fg("accent", text),
@@ -160,13 +170,27 @@ async function selectList<T>(
     });
     list.onSelect = (item) => done(item.value as T);
     list.onCancel = () => done(undefined);
-    container.addChild(list);
-    container.addChild(new Text(theme.fg("dim", "↑↓ select · enter confirm · esc back"), 1, 0));
-    container.addChild(new DynamicBorder((s: string) => theme.fg("borderAccent", s)));
+    const hint = new Text(theme.fg("dim", "↑↓ select · enter confirm · esc back · PgUp/PgDn details"), 1, 0);
     return {
-      render: (width) => container.render(width),
-      invalidate: () => container.invalidate(),
-      handleInput: (data) => list.handleInput(data),
+      render: (width) => {
+        const top = [...border.render(width), ...heading.render(width).slice(0, 2)];
+        const bottom = [...list.render(width), ...hint.render(width), ...border.render(width)];
+        pageSize = Math.max(1, tui.terminal.rows - top.length - bottom.length - 1);
+        const lines = detail.render(width);
+        offset = Math.max(0, Math.min(offset, lines.length - pageSize));
+        return [...top, ...lines.slice(offset, offset + pageSize), ...bottom];
+      },
+      invalidate: () => {
+        heading.invalidate();
+        detail.invalidate();
+        list.invalidate();
+      },
+      handleInput: (data) => {
+        if (matchesKey(data, Key.pageDown)) offset += pageSize;
+        else if (matchesKey(data, Key.pageUp)) offset = Math.max(0, offset - pageSize);
+        else list.handleInput(data);
+        tui.requestRender();
+      },
     };
   });
 }

package/src/vm-bootstrap.ts

@@ -0,0 +1,218 @@
+/** Plain JavaScript bootstrap: no loader, package imports or SDK in the helper. */
+export const VM_BOOTSTRAP = `
+'use strict';
+const vm = require('node:vm');
+const { AsyncLocalStorage, createHook } = require('node:async_hooks');
+const scope = new AsyncLocalStorage();
+const contexts = new Map();
+const localPromises = new Map();
+let rootReturned = false;
+// Only unresolved promises hold local continuation authority. Never retain the
+// promise object itself (GC may destroy an abandoned promise), timers, or a
+// historical async-id pool. Caps are separate from pending callback/RPC limits.
+createHook({
+  init(id,type) {
+    const context = scope.getStore();
+    if (type !== 'PROMISE' || !context || context.released) return;
+    if (localPromises.size >= 65536) throw new Error('workflow local promise limit exceeded');
+    localPromises.set(id,context); context.promises.add(id);
+  },
+  promiseResolve: settlePromise,
+  destroy: settlePromise,
+}).enable();
+function settlePromise(id) {
+  const context = localPromises.get(id);
+  if (!context) return;
+  localPromises.delete(id); context.promises.delete(id);
+  releaseScope(context);
+}
+const callbacks = new Map();
+const callbackIds = new WeakMap();
+const waiting = new Map();
+const scriptErrors = new WeakSet();
+const nativeErrors = new WeakSet();
+let realm;
+function isScriptThrow(value) { return scriptErrors.has(value) || (!(value instanceof Error) && !nativeErrors.has(value)); }
+function thrown(value) { return {value:encode(value),scriptError:isScriptThrow(value),errorText:String(value).slice(0,65536)}; }
+function invalidResult(message) { const error = new Error(message); error.name='WorkflowError'; error.code='SCRIPT_VALIDATION_ERROR'; error.recoverable=false; return error; }
+let sequence = 0, callbackSequence = 0, sent = 0, queuedBytes = 0, logBytes = 0;
+let spent = 0, total = null;
+const MAX_BYTES = 4 * 1024 * 1024;
+function send(message) {
+  const bytes = Buffer.byteLength(JSON.stringify(message));
+  if (bytes > MAX_BYTES || (message.type !== 'heartbeat' && ++sent > 100000) || queuedBytes + bytes > 8 * MAX_BYTES)
+    throw new Error('workflow helper IPC/backpressure limit exceeded');
+  queuedBytes += bytes;
+  process.send(message, error => { queuedBytes -= bytes; if (error) process.exit(1); });
+}
+function encode(value) {
+  const seen = new Map(); let nodes = 0;
+  function visit(v, depth) {
+    if (++nodes > 100000 || depth > 64) throw new Error('workflow intermediate value exceeds IPC limits');
+    if (v === undefined) return ['u'];
+    if (v === null || typeof v === 'string' || typeof v === 'boolean') return ['v', v];
+    if (typeof v === 'number') return ['n', String(v)];
+    if (typeof v === 'bigint') return ['b', String(v)];
+    if (typeof v === 'function') {
+      let id = callbackIds.get(v);
+      if (!id) { if (callbacks.size >= 8192) throw new Error('workflow callback limit exceeded');
+        id = ++callbackSequence; callbackIds.set(v, id); callbacks.set(id, v); }
+      return ['f', id];
+    }
+    if (typeof v !== 'object') throw new Error('unsupported workflow intermediate value');
+    if (seen.has(v)) return ['r', seen.get(v)];
+    const id = seen.size; seen.set(v, id);
+    const tag = Object.prototype.toString.call(v);
+    if (tag === '[object Date]') return ['d', id, v.toISOString()];
+    if (tag === '[object RegExp]') return ['x', id, v.source, v.flags];
+    if (tag === '[object Map]') return ['m', id, [...v].map(([k, x]) => [visit(k, depth + 1), visit(x, depth + 1)])];
+    if (tag === '[object Set]') return ['s', id, [...v].map(x => visit(x, depth + 1))];
+    if (Array.isArray(v)) return ['a', id, Array.from({length:v.length},(_,i)=>Object.hasOwn(v,i) ? visit(v[i],depth+1) : ['h'])];
+    if (tag.endsWith('Error]')) return ['e', id, visit({name:String(v.name), message:String(v.message), code:v.code,
+      recoverable:v.recoverable, agentLabel:v.agentLabel, resetHint:v.resetHint}, depth + 1),isScriptThrow(v)];
+    return ['o', id, Object.keys(v).map(k => [k, visit(v[k], depth + 1)])];
+  }
+  return visit(value, 0);
+}
+function decode(wire) {
+  const refs = new Map();
+  function visit(w) {
+    const [tag, id, data, flags] = w;
+    if (tag === 'u') return undefined;
+    if (tag === 'v') return id;
+    if (tag === 'n') return Number(id);
+    if (tag === 'b') return BigInt(id);
+    if (tag === 'r') return refs.get(id);
+    if (tag === 'f') { const fn = callbacks.get(id); if (!fn) throw new Error('invalid returned workflow callback identity'); return fn; }
+    let value;
+    if (tag === 'a') value = new realm.Array();
+    else if (tag === 'm') value = new realm.Map();
+    else if (tag === 's') value = new realm.Set();
+    else if (tag === 'd') value = new realm.Date(data);
+    else if (tag === 'x') value = new realm.RegExp(data, flags);
+    else if (tag === 'e') value = new realm.Error();
+    else if (tag === 'o') value = new realm.Object();
+    else throw new Error('invalid parent workflow value');
+    refs.set(id, value);
+    if (tag === 'a') for (const x of data) { if (Array.isArray(x) && x.length === 1 && x[0] === 'h') value.length++; else value.push(visit(x)); }
+    if (tag === 'm') for (const [k,x] of data) value.set(visit(k),visit(x));
+    if (tag === 's') for (const x of data) value.add(visit(x));
+    if (tag === 'o') for (const [k,x] of data) Object.defineProperty(value,k,{value:visit(x),writable:true,enumerable:true,configurable:true});
+    if (tag === 'e') {
+      const fields = visit(data);
+      const ctor = Object.hasOwn(realm.errors,fields.name) ? realm.errors[fields.name] : realm.Error;
+      Object.setPrototypeOf(value, ctor.prototype);
+      Object.assign(value, fields);
+      if (flags) scriptErrors.add(value); else nativeErrors.add(value);
+    }
+    return value;
+  }
+  return visit(wire);
+}
+function retireScope(context) {
+  if (context.released) return;
+  context.released = true;
+  contexts.delete(context.id);
+  for (const id of context.promises) localPromises.delete(id);
+  context.promises.clear();
+  send({type:'scopeReleased',id:context.id});
+}
+function releaseScope(context) {
+  if (!context || !context.settled || context.pending || context.releasing || context.released) return;
+  if (!rootReturned && context.promises.size) return;
+  context.releasing = true;
+  // Promise settlement precedes its reactions. Let those reactions post their
+  // RPCs, then recheck real credits. A local unresolved await is credited for
+  // the entire running root, not guessed to have resumed after one I/O turn.
+  setImmediate(() => {
+    context.releasing = false;
+    if (context.pending || context.released || (!rootReturned && context.promises.size)) return;
+    retireScope(context);
+  });
+}
+function closeRootAdmission() {
+  rootReturned = true;
+  // At the root boundary only accepted native work (or its unsettled callback)
+  // carries descendant authority. Ignored, purely local promises cannot keep
+  // the helper alive or mint post-root admission. Release BEFORE root result.
+  for (const context of contexts.values()) {
+    if (context.settled && !context.pending) retireScope(context);
+  }
+}
+function rpc(name, args) {
+  if (waiting.size >= 8192) throw new Error('workflow IPC request limit exceeded');
+  const id = ++sequence;
+  const context = scope.getStore();
+  const promise = new Promise((resolve,reject) => {
+    if (context) context.pending++;
+    waiting.set(id,{resolve,reject,context});
+    try { send({type:'call',id,name,args:encode(args),scope:context?.id}); }
+    catch (error) {
+      waiting.delete(id);
+      if (context) { context.pending--; releaseScope(context); }
+      reject(error);
+    }
+  });
+  // Native helpers already own ignored-call dispositions. Observe the original
+  // RPC promise without changing what author await/catch sees (strict Node).
+  void promise.catch(() => {});
+  return promise;
+}
+function notify(name,args) {
+  const context = scope.getStore();
+  send({type:'notify',name,args:encode(args),scope:context?.id});
+}
+process.on('disconnect', () => process.exit(0));
+process.on('message', message => {
+  if (message.type === 'response') {
+    spent = message.spent;
+    const waiter = waiting.get(message.id); if (!waiter) return;
+    waiting.delete(message.id);
+    try { const value = decode(message.value); if (!message.ok && message.scriptError && value && (typeof value === 'object' || typeof value === 'function')) scriptErrors.add(value); message.ok ? waiter.resolve(value) : waiter.reject(value); }
+    catch (error) { waiter.reject(error); }
+    finally {
+      if (waiter.context) { waiter.context.pending--; releaseScope(waiter.context); }
+    }
+  } else if (message.type === 'callback') {
+    const callback = callbacks.get(message.callback);
+    if (!callback) return process.exit(1);
+    if (contexts.size >= 16384) throw new Error('workflow live execution context limit exceeded');
+    const context = {id:message.id,pending:0,promises:new Set(),settled:false,releasing:false,released:false};
+    contexts.set(context.id,context);
+    scope.run(context, async () => {
+      try { send({type:'callbackResult',id:message.id,ok:true,value:encode(await callback(...decode(message.args)))}); }
+      catch (error) { send({type:'callbackResult',id:message.id,ok:false,...thrown(error)}); }
+      finally { context.settled = true; releaseScope(context); }
+    });
+  } else if (message.type === 'start') {
+    total = message.total; spent = message.spent;
+    const globals = {};
+    for (const name of message.names) globals[name] = (...args) => rpc(name,args);
+    globals.log = value => { const text = String(value); logBytes += Buffer.byteLength(text); if (text.length > 65536 || logBytes > 1024 * 1024) throw new Error('workflow log limit exceeded (64KiB per entry, 1MiB per frame)'); notify('log',[text]); };
+    globals.phase = (title,options) => {
+      if (typeof title !== 'string' || title.length > 4096) throw new TypeError('phase title must be a string of at most 4096 characters');
+      if (options !== undefined && (options === null || typeof options !== 'object' || Array.isArray(options))) throw new TypeError('phase options must be an object');
+      notify('phase',[title,options]);
+    };
+    globals.console = {log:globals.log,info:globals.log,warn:v=>globals.log('[warn] '+String(v)),error:v=>globals.log('[error] '+String(v))};
+    globals.cwd = message.cwd;
+    globals.process = Object.freeze({cwd:()=>message.cwd});
+    globals.budget = Object.freeze({total,spent:()=>spent,remaining:()=>total === null ? Infinity : Math.max(0,total-spent)});
+    const context = vm.createContext(globals);
+    realm = vm.runInContext('({Array,Object,Map,Set,Date,RegExp,Error,errors:{Error,TypeError,RangeError,SyntaxError,ReferenceError,URIError,EvalError,AggregateError}})',context);
+    globals.args = decode(message.args);
+    Promise.resolve().then(() => new vm.Script(message.script,{filename:message.filename}).runInContext(context,{timeout:1000}))
+      .then(result => {
+        try {
+          const serialized = JSON.stringify(result);
+          if (result !== undefined && serialized === undefined) throw new Error('workflow result is not JSON-serializable');
+          const value = encode(serialized === undefined ? undefined : JSON.parse(serialized));
+          closeRootAdmission();
+          send({type:'result',ok:true,value});
+        } catch (error) { throw invalidResult('workflow result is not JSON-serializable: '+error.message); }
+      }).catch(error => send({type:'result',ok:false,...thrown(error)}));
+  }
+});
+setInterval(() => send({type:'heartbeat'}),100).unref();
+send({type:'ready'});
+`;