@stigmer/runner 3.11.0 → 3.12.0

package/src/encryption/config.ts

@@ -1,15 +1,28 @@
 /**
- * Payload-encryption configuration (stigmer-cloud#227).
+ * Payload-encryption configuration (stigmer-cloud#227, stigmer#398).
  *
- * Encryption is enabled iff STIGMER_PAYLOAD_ENCRYPTION_KEY is present —
- * the same enabled-iff-configured pattern as the claim-check codec. A
- * malformed key fails the boot rather than silently running plaintext:
- * an operator who set the key intended history to be encrypted.
+ * Two key sources, strict precedence:
+ *
+ *   1. Environment (STIGMER_PAYLOAD_ENCRYPTION_KEY(_ID)) — the operator's
+ *      explicit choice: self-hosted deployments sharing one key with their
+ *      server, and cloud sandboxes injected with the platform key. When the
+ *      env key is set, bootstrap-delivered material is ignored entirely.
+ *   2. Bootstrap-delivered — server-managed per-identity keys handed to
+ *      desktop-class runners by getRunnerBootstrapConfig. Held in memory
+ *      only; persistence lives server-side, which is what makes Temporal
+ *      replay work across runner restarts (every boot re-fetches the SAME
+ *      key).
+ *
+ * Encryption is enabled iff a key is present from either source — the same
+ * enabled-iff-configured pattern as the claim-check codec. A malformed key
+ * fails the boot rather than silently running plaintext: an operator who set
+ * the key (or a server that minted one) intended history to be encrypted.
  *
  * Key rotation: payloads carry the id of the key that encrypted them.
- * During a rotation window the previous key stays readable via
- * STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY(_ID) while new payloads are
- * written under the primary key.
+ * During a rotation window the previous key stays readable via the
+ * secondary pair while new payloads are written under the primary key.
+ * Workers capture keys at construction, so a rotated bootstrap key lands
+ * on the next runner boot — there is no live re-key.
  */
 
 export interface EncryptionKey {
@@ -25,6 +38,19 @@ export interface PayloadEncryptionConfig {
   readonly secondary?: EncryptionKey;
 }
 
+/**
+ * Server-managed key material delivered by getRunnerBootstrapConfig.
+ * Structurally mirrors {@link BootstrapPayloadEncryptionKeys} in
+ * stigmer-client.ts — declared here so this leaf module stays free of
+ * client imports.
+ */
+export interface BootstrapKeyMaterial {
+  readonly key: string;
+  readonly keyId?: string;
+  readonly secondaryKey?: string;
+  readonly secondaryKeyId?: string;
+}
+
 const KEY_ENV = "STIGMER_PAYLOAD_ENCRYPTION_KEY";
 const KEY_ID_ENV = "STIGMER_PAYLOAD_ENCRYPTION_KEY_ID";
 const SECONDARY_KEY_ENV = "STIGMER_PAYLOAD_ENCRYPTION_SECONDARY_KEY";
@@ -36,29 +62,57 @@ const AES_256_KEY_BYTES = 32;
  * Returns the encryption config, or undefined when encryption is not
  * configured (the codec is then simply not installed).
  *
+ * Source precedence: the env key wins outright; bootstrap-delivered
+ * material applies only when no env key is set (see the module doc).
+ *
  * @throws when a key is present but malformed, or a key id is missing —
  *   key misconfiguration must stop the boot, not degrade to plaintext.
+ *   This applies equally to bootstrap material: a server that hands out
+ *   a bad key or omits its id has broken the protocol contract, and
+ *   running plaintext against a server that manages keys would silently
+ *   defeat the feature.
  */
-export function loadPayloadEncryptionConfig(): PayloadEncryptionConfig | undefined {
+export function loadPayloadEncryptionConfig(
+  bootstrap?: BootstrapKeyMaterial,
+): PayloadEncryptionConfig | undefined {
   const rawKey = process.env[KEY_ENV];
-  if (!rawKey) {
-    return undefined;
+  if (rawKey) {
+    const primary: EncryptionKey = {
+      keyId: requireKeyId(KEY_ID_ENV),
+      key: parseKey(rawKey, KEY_ENV),
+    };
+
+    const rawSecondary = process.env[SECONDARY_KEY_ENV];
+    const secondary: EncryptionKey | undefined = rawSecondary
+      ? {
+          keyId: requireKeyId(SECONDARY_KEY_ID_ENV),
+          key: parseKey(rawSecondary, SECONDARY_KEY_ENV),
+        }
+      : undefined;
+
+    return { primary, secondary };
   }
 
-  const primary: EncryptionKey = {
-    keyId: requireKeyId(KEY_ID_ENV),
-    key: parseKey(rawKey, KEY_ENV),
-  };
+  if (bootstrap?.key) {
+    const primary: EncryptionKey = {
+      keyId: requireBootstrapKeyId(bootstrap.keyId, "payload_encryption_key_id"),
+      key: parseKey(bootstrap.key, "bootstrap payload_encryption_key"),
+    };
 
-  const rawSecondary = process.env[SECONDARY_KEY_ENV];
-  const secondary: EncryptionKey | undefined = rawSecondary
-    ? {
-        keyId: requireKeyId(SECONDARY_KEY_ID_ENV),
-        key: parseKey(rawSecondary, SECONDARY_KEY_ENV),
-      }
-    : undefined;
+    const secondary: EncryptionKey | undefined = bootstrap.secondaryKey
+      ? {
+          keyId: requireBootstrapKeyId(
+            bootstrap.secondaryKeyId,
+            "payload_encryption_secondary_key_id",
+          ),
+          key: parseKey(bootstrap.secondaryKey, "bootstrap payload_encryption_secondary_key"),
+        }
+      : undefined;
 
-  return { primary, secondary };
+    return { primary, secondary };
+  }
+
+  return undefined;
 }
 
 function requireKeyId(envName: string): string {
@@ -74,6 +128,16 @@ function requireKeyId(envName: string): string {
   return keyId;
 }
 
+function requireBootstrapKeyId(keyId: string | undefined, fieldName: string): string {
+  if (!keyId) {
+    throw new Error(
+      `Runner bootstrap returned a payload encryption key without its ${fieldName} — ` +
+        `refusing to encrypt under an unidentified key (server contract violation)`,
+    );
+  }
+  return keyId;
+}
+
 function parseKey(rawBase64: string, envName: string): Buffer {
   let key: Buffer;
   try {

package/src/middleware/__tests__/path-normalization.test.ts

@@ -0,0 +1,140 @@
+import { describe, it, expect, vi } from "vitest";
+import { ToolMessage } from "@langchain/core/messages";
+import {
+  createPathNormalizationMiddleware,
+  normalizeWorkspacePathArg,
+} from "../path-normalization.js";
+import type { ToolCallRequest } from "../types.js";
+
+const ROOT = "/workspace/session-1/repo";
+
+function makeRequest(
+  name: string,
+  args: Record<string, unknown>,
+): ToolCallRequest {
+  return {
+    toolCall: { id: "tc_1", name, args },
+    tool: undefined,
+    state: { messages: [] },
+    runtime: {},
+  };
+}
+
+/** Run the middleware and return the args the inner handler observed. */
+async function argsSeenByHandler(
+  name: string,
+  args: Record<string, unknown>,
+): Promise<Record<string, unknown>> {
+  const mw = createPathNormalizationMiddleware({ rootDir: ROOT });
+  const handler = vi.fn(async (req: ToolCallRequest) => {
+    return new ToolMessage({ content: "ok", tool_call_id: req.toolCall.id, name });
+  });
+  await mw.wrapToolCall!(makeRequest(name, args), handler);
+  expect(handler).toHaveBeenCalledTimes(1);
+  return handler.mock.calls[0][0].toolCall.args;
+}
+
+describe("normalizeWorkspacePathArg", () => {
+  it("maps a workspace-relative path to its rootDir-joined absolute form", () => {
+    expect(normalizeWorkspacePathArg("src/main.py", ROOT)).toBe(`${ROOT}/src/main.py`);
+  });
+
+  it("strips a leading ./ before joining", () => {
+    expect(normalizeWorkspacePathArg("./notes.md", ROOT)).toBe(`${ROOT}/notes.md`);
+  });
+
+  it("handles multi-workspace entry-relative paths", () => {
+    expect(normalizeWorkspacePathArg("entry-1/src/main.py", ROOT)).toBe(
+      `${ROOT}/entry-1/src/main.py`,
+    );
+  });
+
+  it("resolves interior .. segments that stay inside the root", () => {
+    expect(normalizeWorkspacePathArg("src/../notes.md", ROOT)).toBe(`${ROOT}/notes.md`);
+  });
+
+  it("leaves absolute paths untouched", () => {
+    expect(normalizeWorkspacePathArg("/etc/hosts", ROOT)).toBeUndefined();
+    expect(normalizeWorkspacePathArg(`${ROOT}/src/main.py`, ROOT)).toBeUndefined();
+    expect(normalizeWorkspacePathArg("/", ROOT)).toBeUndefined();
+  });
+
+  it("refuses to rewrite relatives that escape the workspace root", () => {
+    // A naive join would resolve `..` away and hand upstream validation a
+    // clean out-of-root absolute path — an out-of-root read that today's
+    // validation refuses. The guard keeps the refusal.
+    expect(normalizeWorkspacePathArg("../sibling/secret.txt", ROOT)).toBeUndefined();
+    expect(normalizeWorkspacePathArg("src/../../escape.txt", ROOT)).toBeUndefined();
+  });
+
+  it("leaves ~-carrying paths untouched (upstream refuses them either way)", () => {
+    expect(normalizeWorkspacePathArg("~/notes.md", ROOT)).toBeUndefined();
+    expect(normalizeWorkspacePathArg("docs/~/x.md", ROOT)).toBeUndefined();
+  });
+
+  it("leaves the empty string untouched", () => {
+    expect(normalizeWorkspacePathArg("", ROOT)).toBeUndefined();
+  });
+});
+
+describe("createPathNormalizationMiddleware", () => {
+  it("rewrites file_path on the file tools", async () => {
+    for (const tool of ["read_file", "write_file", "edit_file"]) {
+      const args = await argsSeenByHandler(tool, {
+        file_path: "src/main.py",
+        content: "x",
+      });
+      expect(args.file_path).toBe(`${ROOT}/src/main.py`);
+      // Sibling args ride along untouched.
+      expect(args.content).toBe("x");
+    }
+  });
+
+  it("rewrites the base path on ls/glob/grep", async () => {
+    for (const tool of ["ls", "glob", "grep"]) {
+      const args = await argsSeenByHandler(tool, { path: "src", pattern: "**/*.py" });
+      expect(args.path).toBe(`${ROOT}/src`);
+      // The pattern is never a path — byte-untouched.
+      expect(args.pattern).toBe("**/*.py");
+    }
+  });
+
+  it("passes absolute paths through byte-untouched", async () => {
+    const args = await argsSeenByHandler("read_file", { file_path: "/etc/hosts" });
+    expect(args.file_path).toBe("/etc/hosts");
+  });
+
+  it("leaves an omitted base path (backend default) alone", async () => {
+    const args = await argsSeenByHandler("ls", {});
+    expect(args.path).toBeUndefined();
+  });
+
+  it("never touches tools outside the built-in filesystem set", async () => {
+    // An MCP tool could plausibly carry a same-named arg with different
+    // semantics; only the six built-in names are rewritten.
+    const args = await argsSeenByHandler("vendor_upload", { file_path: "src/main.py" });
+    expect(args.file_path).toBe("src/main.py");
+  });
+
+  it("leaves non-string path args for the tool's own input validation", async () => {
+    const args = await argsSeenByHandler("read_file", { file_path: 42 });
+    expect(args.file_path).toBe(42);
+  });
+
+  it("preserves the original request identity fields on rewrite", async () => {
+    const mw = createPathNormalizationMiddleware({ rootDir: ROOT });
+    const handler = vi.fn(async (req: ToolCallRequest) => {
+      return new ToolMessage({ content: "ok", tool_call_id: req.toolCall.id, name: req.toolCall.name });
+    });
+    const original = makeRequest("read_file", { file_path: "notes.md" });
+    await mw.wrapToolCall!(original, handler);
+
+    const seen = handler.mock.calls[0][0];
+    expect(seen.toolCall.id).toBe("tc_1");
+    expect(seen.toolCall.name).toBe("read_file");
+    expect(seen.state).toBe(original.state);
+    expect(seen.runtime).toBe(original.runtime);
+    // The original request is never mutated in place.
+    expect(original.toolCall.args.file_path).toBe("notes.md");
+  });
+});

package/src/middleware/index.ts

@@ -4,6 +4,9 @@
  * Assembles the ordered middleware array from a MiddlewareStackConfig.
  * The composition order matches the Python create_deep_agent injection:
  *
+ *   0. Path normalization (conditional: only on permission-rule-bearing
+ *      graphs — FIRST, so every downstream middleware observes canonical
+ *      workspace-absolute paths)
  *   1. Loop detection (always)
  *   2. Execution budget (always)
  *   3. Tool truncation (always)
@@ -15,6 +18,7 @@
 
 import type { StigmerMiddleware, MiddlewareStackConfig } from "./types.js";
 import type { GracefulStopMiddleware } from "./graceful-stop.js";
+import { createPathNormalizationMiddleware } from "./path-normalization.js";
 import { createLoopDetectionMiddleware } from "./loop-detection.js";
 import { createExecutionBudgetMiddleware } from "./execution-budget.js";
 import { createToolTruncationMiddleware } from "./tool-truncation.js";
@@ -39,6 +43,10 @@ export function buildMiddlewareStack(
 ): MiddlewareStackResult {
   const stack: StigmerMiddleware[] = [];
 
+  if (config.pathNormalization) {
+    stack.push(createPathNormalizationMiddleware(config.pathNormalization));
+  }
+
   stack.push(createLoopDetectionMiddleware(config.loopDetection));
 
   stack.push(createExecutionBudgetMiddleware(config.executionBudget));

package/src/middleware/path-normalization.ts

@@ -0,0 +1,125 @@
+/**
+ * Workspace-relative path normalization for permission-rule-bearing graphs
+ * (issue #429).
+ *
+ * deepagents' permission enforcement canonicalizes tool-call paths BEFORE any
+ * rule or backend runs, and its validation refuses non-absolute paths — on
+ * EVERY filesystem tool call once a graph carries any permission rules, reads
+ * included. Plan mode is the only rule-bearing production configuration
+ * (shared/plan-mode-permissions.ts), so there a workspace-relative path —
+ * the shape the multi-workspace prompt explicitly mandates, and one models
+ * routinely choose in single-workspace sessions — fails with
+ * `path must be absolute` instead of just working, burning tool rounds until
+ * the model adapts by switching to absolute paths.
+ *
+ * This middleware repairs the contract at our own seam: it rewrites
+ * workspace-relative paths on the deepagents built-in filesystem tools to
+ * workspace-absolute before the tool (and therefore enforcement) runs. The
+ * write-deny rule then fires as designed and reads succeed on the first try.
+ * Rule-less (act-mode) graphs never install it — the legacy backend already
+ * resolves relative paths under the workspace root, so act mode keeps a
+ * byte-zero delta.
+ *
+ * Invariant — nothing becomes newly reachable: only paths whose resolution
+ * stays INSIDE the workspace root are rewritten. Escaping relatives (`../x`)
+ * and `~`-carrying paths are left raw so today's validation refusal keeps
+ * speaking (a naive join would resolve `..` away and smuggle an out-of-root
+ * read past validation), and absolute paths pass through byte-untouched.
+ * The middleware converts false errors into correct behavior — never a
+ * refusal into an allowance the rules didn't decide.
+ *
+ * Tool matching is by bare built-in name, the house doctrine (an MCP server
+ * is not expected to shadow a built-in name — see shared/tool-kind.ts); the
+ * rewrite touches only the tool's path-bearing argument, never glob/grep
+ * patterns. Install FIRST in the stack so every downstream middleware
+ * (approval gate, error hints, otel spans) observes canonical paths.
+ */
+
+import { isAbsolute, relative } from "node:path";
+import { resolveWorkspacePath } from "../shared/file-change.js";
+import type { StigmerMiddleware } from "./types.js";
+
+/**
+ * The path-bearing argument of each deepagents built-in filesystem tool.
+ * `ls`/`glob`/`grep` take a base directory `path` (defaulting to "/" when
+ * omitted — absolute, so untouched here); the file tools take `file_path`.
+ * Confirmed against the installed deepagents' tool definitions.
+ */
+const PATH_ARG_BY_TOOL: ReadonlyMap<string, string> = new Map([
+  ["ls", "path"],
+  ["glob", "path"],
+  ["grep", "path"],
+  ["read_file", "file_path"],
+  ["write_file", "file_path"],
+  ["edit_file", "file_path"],
+]);
+
+export interface PathNormalizationConfig {
+  /** The workspace root the graph's filesystem backend resolves against. */
+  readonly rootDir: string;
+}
+
+/**
+ * Rewrite `raw` to its workspace-absolute form, or return undefined when the
+ * value must be left untouched (absolute already, `~`-carrying, or escaping
+ * the workspace root). Exported for direct unit testing of the mapping table.
+ */
+export function normalizeWorkspacePathArg(
+  raw: string,
+  rootDir: string,
+): string | undefined {
+  if (raw.length === 0 || isAbsolute(raw)) return undefined;
+  // Upstream validation refuses `~` segments even in absolute paths, so a
+  // rewrite could not make such a call succeed — leave the raw shape (and
+  // therefore the honest refusal) intact.
+  if (raw.split("/").includes("~")) return undefined;
+
+  const { absolutePath } = resolveWorkspacePath(raw, rootDir, false);
+
+  // No-new-reachability guard: `join` inside the resolver normalizes `..`
+  // segments away, so an escaping relative would otherwise pass upstream
+  // validation as a clean out-of-root absolute path. Today that shape is
+  // refused; keep it that way.
+  const rel = relative(rootDir, absolutePath);
+  if (rel.startsWith("..") || isAbsolute(rel)) return undefined;
+
+  return absolutePath;
+}
+
+/**
+ * Create middleware that normalizes workspace-relative paths on the built-in
+ * filesystem tools before permission enforcement sees them.
+ *
+ * Installed only on graphs that carry filesystem permission rules — derive
+ * the install condition from the same expression that supplies the rules
+ * (setup.ts / compileSubagents) so the rules and their normalization shim
+ * cannot drift apart.
+ */
+export function createPathNormalizationMiddleware(
+  config: PathNormalizationConfig,
+): StigmerMiddleware {
+  const { rootDir } = config;
+
+  return {
+    name: "PathNormalizationMiddleware",
+
+    wrapToolCall(request, handler) {
+      const argKey = PATH_ARG_BY_TOOL.get(request.toolCall.name);
+      if (!argKey) return handler(request);
+
+      const raw = request.toolCall.args[argKey];
+      if (typeof raw !== "string") return handler(request);
+
+      const normalized = normalizeWorkspacePathArg(raw, rootDir);
+      if (normalized === undefined) return handler(request);
+
+      return handler({
+        ...request,
+        toolCall: {
+          ...request.toolCall,
+          args: { ...request.toolCall.args, [argKey]: normalized },
+        },
+      });
+    },
+  };
+}

package/src/middleware/types.ts

@@ -100,6 +100,11 @@ export interface OtelSpansConfig {
 import type { ApprovalGateConfig } from "./approval-gate.js";
 export type { ApprovalGateConfig };
 
+// Same idiom as ApprovalGateConfig above: the normalization middleware
+// consumes it, this module re-exports it for stack-config assembly.
+import type { PathNormalizationConfig } from "./path-normalization.js";
+export type { PathNormalizationConfig };
+
 /**
  * Top-level configuration for buildMiddlewareStack().
  * All sections are optional — the factory applies sensible defaults.
@@ -111,4 +116,10 @@ export interface MiddlewareStackConfig {
   readonly costCap?: CostCapConfig | null;
   readonly otelSpans?: Partial<OtelSpansConfig>;
   readonly approvalGate?: ApprovalGateConfig | null;
+  /**
+   * Workspace-relative path normalization (issue #429). Set iff the graph
+   * carries filesystem permission rules — derive from the same expression
+   * that supplies the rules so the two cannot drift apart.
+   */
+  readonly pathNormalization?: PathNormalizationConfig | null;
 }

package/src/payload-codecs.ts

@@ -14,20 +14,26 @@
 
 import type { PayloadCodec } from "@temporalio/common";
 import type { Config } from "./config.js";
+import type { BootstrapKeyMaterial } from "./encryption/config.js";
 
 export async function createPayloadCodecs(
   config: Config,
+  bootstrapKeys?: BootstrapKeyMaterial,
 ): Promise<PayloadCodec[] | undefined> {
   const codecs: PayloadCodec[] = [];
 
   const { loadPayloadEncryptionConfig, EncryptionPayloadCodec } = await import(
     "./encryption/index.js"
   );
-  const encryptionConfig = loadPayloadEncryptionConfig();
+  // Env-configured keys win outright; server-managed (bootstrap) keys apply
+  // only when the env is silent — see encryption/config.ts for the rationale.
+  const encryptionConfig = loadPayloadEncryptionConfig(bootstrapKeys);
   if (encryptionConfig) {
     codecs.push(new EncryptionPayloadCodec(encryptionConfig));
+    const source = process.env.STIGMER_PAYLOAD_ENCRYPTION_KEY ? "env" : "bootstrap";
     console.log(
-      `[runner] Payload encryption enabled (key_id=${encryptionConfig.primary.keyId}` +
+      `[runner] Payload encryption enabled (source=${source}, ` +
+        `key_id=${encryptionConfig.primary.keyId}` +
         (encryptionConfig.secondary
           ? `, secondary_key_id=${encryptionConfig.secondary.keyId})`
           : ")"),

package/src/runner-manager.ts

@@ -293,8 +293,10 @@ export async function createStigmerRunnerManager(
   // Resolve the runner bootstrap after the http2 patch is in place (discovery
   // dials the control plane through connect-node). An explicit address wins;
   // otherwise a token triggers control-plane discovery; otherwise localhost.
-  // Must happen before createAllActivities so runtime activities that dial
-  // Temporal (e.g. emit-event) see the resolved address too.
+  // Must happen before createAllActivities so the activities' Config carries
+  // the resolved coordinates. Only the worker connection dials Temporal — no
+  // activity does (emit-event, the last one, now routes signals through the
+  // server's SendSignal lane; see oss#517).
   const bootstrap = await resolveRunnerBootstrap({
     explicitAddress: options.temporalAddress,
     explicitNamespace: options.temporalNamespace,
@@ -354,7 +356,23 @@ export async function createStigmerRunnerManager(
     );
   }
   const { createPayloadCodecs } = await import("./payload-codecs.js");
-  const payloadCodecs = await createPayloadCodecs(config);
+  // Server-managed payload-encryption keys (cloud desktop runners) ride the
+  // bootstrap response; an env-configured key still wins inside the loader.
+  // A cloud server that mints runner tokens but returns no key predates key
+  // management — payloads then rest plaintext in cloud Temporal history, which
+  // deserves a diagnosable warning rather than silence.
+  const payloadCodecs = await createPayloadCodecs(config, bootstrap.payloadEncryption);
+  if (
+    !bootstrap.payloadEncryption &&
+    bootstrap.runnerAccessToken &&
+    !process.env.STIGMER_PAYLOAD_ENCRYPTION_KEY
+  ) {
+    console.warn(
+      "[runner-manager] Server minted a runner token but returned no payload " +
+        "encryption key; Temporal payloads will be plaintext (server predates " +
+        "runner key management?)",
+    );
+  }
 
   const connection = await NativeConnection.connect({
     address: config.temporalAddress,

package/src/runner.ts

@@ -237,8 +237,9 @@ export async function createStigmerRunner(
   // Resolve Temporal coordinates after the http2 patch is in place (discovery
   // dials the control plane through connect-node). Explicit address wins;
   // otherwise a token triggers control-plane discovery; otherwise localhost.
-  // Activities that dial Temporal at runtime (e.g. emit-event) read
-  // config.temporalAddress, so this must precede their creation.
+  // Only the worker connection consumes these coordinates — no activity dials
+  // Temporal directly (emit-event, the last one, now routes signals through
+  // the server's SendSignal lane; see oss#517).
   //
   // The static runner brings its own already-proxy-valid token (harness/CLI),
   // so it does not consume the minted runner token from the bootstrap response;
@@ -305,7 +306,10 @@ export async function createStigmerRunner(
   }
 
   const { createPayloadCodecs } = await import("./payload-codecs.js");
-  const payloadCodecs = await createPayloadCodecs(config);
+  // Server-managed keys from the bootstrap response apply here too (a CLI
+  // daemon with a cloud token is desktop-class); cloud sandboxes are
+  // unaffected — their env-injected platform key wins inside the loader.
+  const payloadCodecs = await createPayloadCodecs(config, coordinates.payloadEncryption);
 
   const { startWorker } = await import("./worker.js");
   const worker = await startWorker({ config, activities, payloadCodecs });