@te-river/opencode-team-mode 1.5.4 → 1.5.6

package/dist/tm/ptc/contract.d.ts

@@ -0,0 +1,131 @@
+/**
+ * tm_ptc_run — public contract types + the frozen engine seam.
+ *
+ * Design: .git/opencode-team/.../ptc-run/02-architect-ptc-run-design.md §2/§3.
+ * Everything in this module is CONTRACT — frozen since M1 so M2's engines and
+ * M3's registration could land without touching the driver or the tool.
+ * (Split out of the former monolithic ptc.ts; behavior unchanged.)
+ *
+ * Governance is REUSED, never forked (D6 lock): the bridge calls the exact
+ * four exported pipelines, so threshold offload, P2/P3, R6 and handle/TTL
+ * semantics apply to every bridged call verbatim.  PTC is NOT a bypass layer.
+ */
+import type { TmPhase } from "../result.js";
+/** The five PTC run statuses (design §2). */
+export declare const PTC_STATUS_VALUES: readonly ["ok", "stopped-error-budget", "stopped-call-budget", "timeout", "engine-error"];
+export type PtcStatus = (typeof PTC_STATUS_VALUES)[number];
+export type BridgeTool = "tm_read" | "tm_grep" | "tm_bash" | "tm_fetch";
+/** Bridge allow set — read-only; tm_ptc_run itself is excluded (no nesting). */
+export declare const BRIDGE_ALLOW: readonly BridgeTool[];
+/** Phases safe to retry once (idempotent read-only bridges; design §4.2). */
+export declare const RETRYABLE_PHASES: readonly TmPhase[];
+/** Error body the bridge surfaces (T1.4 shape: tool/phase/message/line?). */
+export interface PtcErrorBody {
+    tool: string;
+    phase: TmPhase;
+    message: string;
+    line?: number;
+}
+/** A single bridged-call outcome (design §2 program protocol). */
+export type PtcCallResult = {
+    ok: true;
+    data: unknown;
+} | {
+    ok: false;
+    error: PtcErrorBody;
+};
+/** The bridge the engine drives — every call runs the gate-wrapped pipelines. */
+export interface PtcBridge {
+    call(tool: BridgeTool, args: Record<string, unknown>): Promise<PtcCallResult>;
+}
+/** Parent → engine: run the program. */
+export interface PtcRunRequest {
+    program: string;
+    /** monotonic token so a caller can correlate a call with its response. */
+    startDeadlineMs: number;
+}
+/** Engine → driver: a single bridged call to execute under the gate. */
+export interface PtcRpcRequest {
+    t: "call";
+    id: number;
+    tool: BridgeTool;
+    args: Record<string, unknown>;
+}
+/** Driver → engine: the gated result of a call. */
+export interface PtcRpcResponse {
+    t: "result";
+    id: number;
+    r: PtcCallResult;
+}
+/** Driver → engine: stop the run (budget / time hit); engine must unwind. */
+export interface PtcRpcAbort {
+    t: "abort";
+    id: number;
+    reason: "timeout" | "error-budget" | "call-budget";
+}
+export type PtcEngineMessage = PtcRpcRequest | PtcRpcResponse | PtcRpcAbort;
+export type PtcEngineName = "worker" | "inline";
+/**
+ * The engine seam — FROZEN.  InlineSequentialEngine shipped in M1,
+ * WorkerEngine + InlineVmEngine in M2; a future engine implements this same
+ * shape and neither the driver nor the tool changes.
+ */
+export interface PtcEngine {
+    readonly name: PtcEngineName;
+    /**
+     * Run `program`, driving every bridge call through `bridge` (already
+     * gate-wrapped by the driver). Resolve with the program's return value;
+     * reject with a `PtcStopSignal` for a budget/time stop, or any other Error
+     * for an engine/program fault. `signal` lets the driver race a timeout.
+     */
+    run(program: string, bridge: PtcBridge, signal: AbortSignal): Promise<unknown>;
+}
+/**
+ * The stop signal unwinding a program on a budget/time hit.  Thrown by the
+ * StepGate (call/error budget, pre-call deadline) and rejected through the
+ * engines' abort promises (wall-clock timeout); caught by the driver, which
+ * maps it to a status.  Never escapes as an engine-error.
+ */
+export declare class PtcStopSignal extends Error {
+    readonly reason: "timeout" | "error-budget" | "call-budget";
+    constructor(reason: "timeout" | "error-budget" | "call-budget");
+}
+/** Short display code for a ref: the `steps/<id>` step segment.  Shared by
+ *  the gate (success table) and the summary renderer (error refs). */
+export declare function shortRefCode(ref: string): string;
+export interface PtcStepRecord {
+    n: number;
+    tool: BridgeTool;
+    ok: boolean;
+    ms: number;
+    /** ok rows: estimated tokens (inline text) or the offload handle's tokens. */
+    tokens: number;
+    /** ok rows: "inline" or a short ref code for an offloaded payload. */
+    dest: string;
+    /** ok rows: the offload ref (when the data was a handle), else null. */
+    ref?: string | null;
+    /** err rows only. */
+    phase?: TmPhase;
+    line?: number;
+    retry?: boolean;
+    message?: string;
+    errorRef?: string;
+}
+export interface PtcRunOutcome {
+    label: string;
+    status: PtcStatus;
+    steps: PtcStepRecord[];
+    okCount: number;
+    errCount: number;
+    retries: number;
+    calls: number;
+    ms: number;
+    engine: PtcEngineName;
+    degraded: boolean;
+    returnValue: unknown;
+    returned: boolean;
+    /** set when the program threw (status=engine-error). */
+    engineError?: PtcErrorBody;
+    parentStepId: string;
+}
+//# sourceMappingURL=contract.d.ts.map

package/dist/tm/ptc/contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../../src/tm/ptc/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAK3C,6CAA6C;AAC7C,eAAO,MAAM,iBAAiB,2FAMpB,CAAA;AACV,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE1D,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAA;AAEvE,gFAAgF;AAChF,eAAO,MAAM,YAAY,EAAE,SAAS,UAAU,EAAkD,CAAA;AAEhG,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,EAAE,SAAS,OAAO,EAAmC,CAAA;AAElF,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,OAAO,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,kEAAkE;AAClE,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC3B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,CAAA;AAEtC,iFAAiF;AACjF,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;CAC9E;AAID,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,0EAA0E;IAC1E,eAAe,EAAE,MAAM,CAAA;CACxB;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,CAAC,EAAE,MAAM,CAAA;IACT,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,UAAU,CAAA;IAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAED,mDAAmD;AACnD,MAAM,WAAW,cAAc;IAC7B,CAAC,EAAE,QAAQ,CAAA;IACX,EAAE,EAAE,MAAM,CAAA;IACV,CAAC,EAAE,aAAa,CAAA;CACjB;AAED,6EAA6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,OAAO,CAAA;IACV,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,SAAS,GAAG,cAAc,GAAG,aAAa,CAAA;CACnD;AAED,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,cAAc,GAAG,WAAW,CAAA;AAE3E,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAE/C;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B;;;;;OAKG;IACH,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CAC/E;AAED;;;;;GAKG;AACH,qBAAa,aAAc,SAAQ,KAAK;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,cAAc,GAAG,aAAa;gBAAlD,MAAM,EAAE,SAAS,GAAG,cAAc,GAAG,aAAa;CAIxE;AAED;sEACsE;AACtE,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGhD;AAID,MAAM,WAAW,aAAa;IAC5B,CAAC,EAAE,MAAM,CAAA;IACT,IAAI,EAAE,UAAU,CAAA;IAChB,EAAE,EAAE,OAAO,CAAA;IACX,EAAE,EAAE,MAAM,CAAA;IACV,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAA;IACd,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAA;IACZ,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,qBAAqB;IACrB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,SAAS,CAAA;IACjB,KAAK,EAAE,aAAa,EAAE,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,aAAa,CAAA;IACrB,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,OAAO,CAAA;IACpB,QAAQ,EAAE,OAAO,CAAA;IACjB,wDAAwD;IACxD,WAAW,CAAC,EAAE,YAAY,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;CACrB"}

package/dist/tm/ptc/contract.js

@@ -0,0 +1,47 @@
+/**
+ * tm_ptc_run — public contract types + the frozen engine seam.
+ *
+ * Design: .git/opencode-team/.../ptc-run/02-architect-ptc-run-design.md §2/§3.
+ * Everything in this module is CONTRACT — frozen since M1 so M2's engines and
+ * M3's registration could land without touching the driver or the tool.
+ * (Split out of the former monolithic ptc.ts; behavior unchanged.)
+ *
+ * Governance is REUSED, never forked (D6 lock): the bridge calls the exact
+ * four exported pipelines, so threshold offload, P2/P3, R6 and handle/TTL
+ * semantics apply to every bridged call verbatim.  PTC is NOT a bypass layer.
+ */
+import { shorten } from "../config.js";
+// ---------- statuses + bridge surface (design §2) ---------------------------
+/** The five PTC run statuses (design §2). */
+export const PTC_STATUS_VALUES = [
+    "ok",
+    "stopped-error-budget",
+    "stopped-call-budget",
+    "timeout",
+    "engine-error",
+];
+/** Bridge allow set — read-only; tm_ptc_run itself is excluded (no nesting). */
+export const BRIDGE_ALLOW = ["tm_read", "tm_grep", "tm_bash", "tm_fetch"];
+/** Phases safe to retry once (idempotent read-only bridges; design §4.2). */
+export const RETRYABLE_PHASES = ["client", "execute", "store"];
+/**
+ * The stop signal unwinding a program on a budget/time hit.  Thrown by the
+ * StepGate (call/error budget, pre-call deadline) and rejected through the
+ * engines' abort promises (wall-clock timeout); caught by the driver, which
+ * maps it to a status.  Never escapes as an engine-error.
+ */
+export class PtcStopSignal extends Error {
+    reason;
+    constructor(reason) {
+        super(`ptc-stop:${reason}`);
+        this.reason = reason;
+        this.name = "PtcStopSignal";
+    }
+}
+/** Short display code for a ref: the `steps/<id>` step segment.  Shared by
+ *  the gate (success table) and the summary renderer (error refs). */
+export function shortRefCode(ref) {
+    const m = /\/steps\/([^/]+)\/result/.exec(ref);
+    return m ? m[1] : shorten(ref, 24);
+}
+//# sourceMappingURL=contract.js.map

package/dist/tm/ptc/contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../../src/tm/ptc/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,+EAA+E;AAE/E,6CAA6C;AAC7C,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,IAAI;IACJ,sBAAsB;IACtB,qBAAqB;IACrB,SAAS;IACT,cAAc;CACN,CAAA;AAKV,gFAAgF;AAChF,MAAM,CAAC,MAAM,YAAY,GAA0B,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;AAEhG,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAuB,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;AAuElF;;;;;GAKG;AACH,MAAM,OAAO,aAAc,SAAQ,KAAK;IACjB;IAArB,YAAqB,MAAkD;QACrE,KAAK,CAAC,YAAY,MAAM,EAAE,CAAC,CAAA;QADR,WAAM,GAAN,MAAM,CAA4C;QAErE,IAAI,CAAC,IAAI,GAAG,eAAe,CAAA;IAC7B,CAAC;CACF;AAED;sEACsE;AACtE,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,CAAC,GAAG,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC9C,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;AACpC,CAAC"}

package/dist/tm/ptc/driver.d.ts

@@ -0,0 +1,37 @@
+/**
+ * tm_ptc_run — the run driver: engine selection (auto / worker / inline),
+ * the static pre-scan handoff, wall-clock timeout, status mapping, and the
+ * trajectory parent events.  Split out of the former monolithic ptc.ts;
+ * behavior unchanged.
+ */
+import type { TmConfig } from "../config.js";
+import type { RunStore } from "../store.js";
+import type { PtcBridge, PtcEngine, PtcRunOutcome } from "./contract.js";
+import type { PtcBudgets } from "./budgets.js";
+export interface EngineSelection {
+    engine: PtcEngine;
+    /** true when the auto chain degraded from worker to inline. */
+    degraded: boolean;
+}
+/**
+ * Select the PTC engine based on the TM_PTC_ENGINE mode.
+ *  - "worker": WorkerEngine only (throws on failure → engine-error status).
+ *  - "inline": InlineVmEngine only (script timeout for pre-await busy-loops).
+ *  - "auto" (default): worker-first — the REAL auto-degrade happens in
+ *    runPtc, which re-runs the whole program on InlineVmEngine when a worker
+ *    run returns engine-error.
+ */
+export declare function selectEngine(mode: "auto" | "worker" | "inline", bridge: PtcBridge): EngineSelection;
+export interface RunPtcOptions {
+    program: string;
+    label: string;
+    budgets: PtcBudgets;
+    parentStepId: string;
+    cfg: TmConfig;
+    store?: RunStore;
+    bridge: PtcBridge;
+    engine?: PtcEngine;
+    now?: () => number;
+}
+export declare function runPtc(o: RunPtcOptions): Promise<PtcRunOutcome>;
+//# sourceMappingURL=driver.d.ts.map

package/dist/tm/ptc/driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"driver.d.ts","sourceRoot":"","sources":["../../../src/tm/ptc/driver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAa,MAAM,eAAe,CAAA;AAMnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAI9C,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,SAAS,CAAA;IACjB,+DAA+D;IAC/D,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,EAAE,MAAM,EAAE,SAAS,GAAG,eAAe,CAQnG;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,UAAU,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,GAAG,EAAE,QAAQ,CAAA;IACb,KAAK,CAAC,EAAE,QAAQ,CAAA;IAChB,MAAM,EAAE,SAAS,CAAA;IACjB,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED,wBAAsB,MAAM,CAAC,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAwIrE"}

package/dist/tm/ptc/driver.js

@@ -0,0 +1,181 @@
+/**
+ * tm_ptc_run — the run driver: engine selection (auto / worker / inline),
+ * the static pre-scan handoff, wall-clock timeout, status mapping, and the
+ * trajectory parent events.  Split out of the former monolithic ptc.ts;
+ * behavior unchanged.
+ */
+import * as crypto from "node:crypto";
+import { PtcStopSignal } from "./contract.js";
+import { createGateBridge } from "./gate.js";
+import { InlineVmEngine, WorkerEngine } from "./engines.js";
+import { staticPscan } from "./pscan.js";
+/**
+ * Select the PTC engine based on the TM_PTC_ENGINE mode.
+ *  - "worker": WorkerEngine only (throws on failure → engine-error status).
+ *  - "inline": InlineVmEngine only (script timeout for pre-await busy-loops).
+ *  - "auto" (default): worker-first — the REAL auto-degrade happens in
+ *    runPtc, which re-runs the whole program on InlineVmEngine when a worker
+ *    run returns engine-error.
+ */
+export function selectEngine(mode, bridge) {
+    void bridge;
+    if (mode === "inline") {
+        return { engine: new InlineVmEngine(), degraded: false };
+    }
+    // auto and worker both start on the worker engine (construction never
+    // throws — no spawn until run()).
+    return { engine: new WorkerEngine(), degraded: false };
+}
+export async function runPtc(o) {
+    const now = o.now ?? Date.now;
+    const start = now();
+    const deadlineAt = start + o.budgets.timeoutMs;
+    // engine selection — explicit override or auto/worker/inline from config.
+    let engine;
+    let degraded = false;
+    if (o.engine) {
+        engine = o.engine;
+    }
+    else {
+        const sel = selectEngine(o.cfg.ptcEngine, o.bridge);
+        engine = sel.engine;
+        degraded = sel.degraded;
+    }
+    // static pre-scan — reject programs with banned tokens before any
+    // engine runs.  Shape: engine-error with the pscan tokens listed.
+    // (Design §3: "辅助手段，声明不作安全边界".)
+    const pscan = staticPscan(o.program);
+    if (pscan.rejected) {
+        return {
+            label: o.label,
+            status: "engine-error",
+            steps: [],
+            okCount: 0,
+            errCount: 0,
+            retries: 0,
+            calls: 0,
+            ms: 0,
+            engine: engine.name,
+            degraded,
+            returnValue: undefined,
+            returned: false,
+            engineError: {
+                tool: "tm_ptc_run",
+                phase: "args",
+                message: `程序包含禁止标识符（${pscan.tokens.join(", ")}），已拒绝执行。`,
+            },
+            parentStepId: o.parentStepId,
+        };
+    }
+    // Auto-degrade: if the selected engine throws (not a PtcStopSignal),
+    // and we're in auto mode with no explicit override, retry with InlineVmEngine.
+    const tryRun = async (eng) => {
+        const state = { calls: 0, errors: 0, retries: 0, steps: [] };
+        const gate = createGateBridge(o.bridge, o.parentStepId, o.budgets, state, {
+            now,
+            deadlineAt,
+            store: o.store,
+        });
+        // parent call event (design §6)
+        o.store?.appendTrajectory({
+            tool: "tm_ptc_run",
+            step_id: o.parentStepId,
+            event: "call",
+            label: o.label,
+            program_sha256: crypto.createHash("sha256").update(o.program).digest("hex"),
+            budgets: o.budgets,
+        });
+        const ac = new AbortController();
+        const remaining = Math.max(0, deadlineAt - now());
+        const timer = setTimeout(() => ac.abort(), remaining);
+        let status;
+        let returnValue;
+        let returned = false;
+        let engineError;
+        try {
+            returnValue = await eng.run(o.program, gate, ac.signal);
+            returned = true;
+            status = state.stopReason ? mapStop(state.stopReason) : "ok";
+        }
+        catch (err) {
+            if (err instanceof PtcStopSignal) {
+                status = mapStop(err.reason);
+            }
+            else {
+                status = "engine-error";
+                const line = extractLine(err);
+                engineError = {
+                    tool: "tm_ptc_run",
+                    phase: "execute",
+                    message: err instanceof Error ? err.message : String(err ?? "engine error"),
+                    ...(line != null ? { line } : {}),
+                };
+            }
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        const ms = now() - start;
+        const outcome = {
+            label: o.label,
+            status,
+            steps: state.steps,
+            okCount: state.steps.filter((s) => s.ok).length,
+            errCount: state.steps.filter((s) => !s.ok).length,
+            retries: state.retries,
+            calls: state.calls,
+            ms,
+            engine: eng.name,
+            degraded,
+            returnValue,
+            returned,
+            ...(engineError ? { engineError } : {}),
+            parentStepId: o.parentStepId,
+        };
+        o.store?.appendTrajectory({
+            tool: "tm_ptc_run",
+            step_id: o.parentStepId,
+            event: "finish",
+            status: outcome.status,
+            calls: outcome.calls,
+            errors: outcome.errCount,
+            retries: outcome.retries,
+            ms: outcome.ms,
+        });
+        return outcome;
+    };
+    // Auto mode: try worker first; on engine-error → degrade to inline.
+    if (!o.engine && o.cfg.ptcEngine === "auto" && engine.name === "worker") {
+        const result = await tryRun(engine);
+        if (result.status === "engine-error") {
+            // Degrade to inline-vm and re-run.
+            const inlineEngine = new InlineVmEngine();
+            const fallback = await tryRun(inlineEngine);
+            fallback.degraded = true;
+            fallback.engine = "inline";
+            return fallback;
+        }
+        return result;
+    }
+    return tryRun(engine);
+}
+function mapStop(reason) {
+    if (reason === "timeout")
+        return "timeout";
+    if (reason === "error-budget")
+        return "stopped-error-budget";
+    return "stopped-call-budget";
+}
+/** Best-effort line extraction from a program-side thrown error stack. */
+function extractLine(err) {
+    const s = err instanceof Error ? err.stack ?? "" : String(err ?? "");
+    const m = /:(\d+):/.exec(s);
+    if (m) {
+        const n = Number(m[1]);
+        if (Number.isFinite(n))
+            return n;
+    }
+    const m2 = /line[:#]?\s*(\d+)/i.exec(s);
+    return m2 ? Number(m2[1]) : undefined;
+}
+//# sourceMappingURL=driver.js.map

package/dist/tm/ptc/driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"driver.js","sourceRoot":"","sources":["../../../src/tm/ptc/driver.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAIrC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAE7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAWxC;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,IAAkC,EAAE,MAAiB;IAChF,KAAK,MAAM,CAAA;IACX,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,IAAI,cAAc,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;IAC1D,CAAC;IACD,sEAAsE;IACtE,kCAAkC;IAClC,OAAO,EAAE,MAAM,EAAE,IAAI,YAAY,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;AACxD,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,CAAgB;IAC3C,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IAC7B,MAAM,KAAK,GAAG,GAAG,EAAE,CAAA;IACnB,MAAM,UAAU,GAAG,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,CAAA;IAC9C,0EAA0E;IAC1E,IAAI,MAAiB,CAAA;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACb,MAAM,GAAG,CAAC,CAAC,MAAM,CAAA;IACnB,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAA;QACnD,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;QACnB,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAA;IACzB,CAAC;IAED,kEAAkE;IAClE,kEAAkE;IAClE,gCAAgC;IAChC,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IACpC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,OAAO;YACL,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,cAAc;YACtB,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,CAAC;YACR,EAAE,EAAE,CAAC;YACL,MAAM,EAAE,MAAM,CAAC,IAAI;YACnB,QAAQ;YACR,WAAW,EAAE,SAAS;YACtB,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE;gBACX,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,aAAa,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU;aACxD;YACD,YAAY,EAAE,CAAC,CAAC,YAAY;SAC7B,CAAA;IACH,CAAC;IAED,qEAAqE;IACrE,+EAA+E;IAC/E,MAAM,MAAM,GAAG,KAAK,EAAE,GAAc,EAA0B,EAAE;QAC9D,MAAM,KAAK,GAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;QACvE,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE;YACxE,GAAG;YACH,UAAU;YACV,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAA;QAEF,gCAAgC;QAChC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC;YACxB,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,CAAC,CAAC,YAAY;YACvB,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC3E,OAAO,EAAE,CAAC,CAAC,OAAO;SACnB,CAAC,CAAA;QAEF,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAA;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,GAAG,EAAE,CAAC,CAAA;QACjD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAA;QAErD,IAAI,MAAiB,CAAA;QACrB,IAAI,WAAoB,CAAA;QACxB,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,IAAI,WAAyC,CAAA;QAC7C,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;YACvD,QAAQ,GAAG,IAAI,CAAA;YACf,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;gBACjC,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC9B,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,cAAc,CAAA;gBACvB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;gBAC7B,WAAW,GAAG;oBACZ,IAAI,EAAE,YAAY;oBAClB,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,cAAc,CAAC;oBAC3E,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClC,CAAA;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;QAED,MAAM,EAAE,GAAG,GAAG,EAAE,GAAG,KAAK,CAAA;QACxB,MAAM,OAAO,GAAkB;YAC7B,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM;YAC/C,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM;YACjD,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,EAAE;YACF,MAAM,EAAE,GAAG,CAAC,IAAI;YAChB,QAAQ;YACR,WAAW;YACX,QAAQ;YACR,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,YAAY,EAAE,CAAC,CAAC,YAAY;SAC7B,CAAA;QACD,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC;YACxB,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,CAAC,CAAC,YAAY;YACvB,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,QAAQ;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,CAAC,CAAA;QACF,OAAO,OAAO,CAAA;IAChB,CAAC,CAAA;IAED,oEAAoE;IACpE,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAA;QACnC,IAAI,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;YACrC,mCAAmC;YACnC,MAAM,YAAY,GAAG,IAAI,cAAc,EAAE,CAAA;YACzC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAA;YAC3C,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAA;YACxB,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAA;YAC1B,OAAO,QAAQ,CAAA;QACjB,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;AACvB,CAAC;AAED,SAAS,OAAO,CAAC,MAAkD;IACjE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC1C,IAAI,MAAM,KAAK,cAAc;QAAE,OAAO,sBAAsB,CAAA;IAC5D,OAAO,qBAAqB,CAAA;AAC9B,CAAC;AAED,0EAA0E;AAC1E,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;IACpE,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC3B,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACtB,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IAClC,CAAC;IACD,MAAM,EAAE,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACvC,CAAC"}

package/dist/tm/ptc/engines.d.ts

@@ -0,0 +1,32 @@
+/**
+ * tm_ptc_run — the three engines behind the frozen `PtcEngine` seam.
+ * Split out of the former monolithic ptc.ts; behavior unchanged.
+ *
+ * M1 legacy: InlineSequentialEngine (test-only — runs on the MAIN thread,
+ * no sandbox, no timeout; a post-await busy loop blocks the host event loop
+ * irrecoverably).
+ * M2 primary: WorkerEngine (worker_threads + MessagePort RPC, env:{},
+ * resourceLimits, hard `terminate()` wall-clock kill; bootstrap as a
+ * build-time string, strict-mode program body).
+ * M2 fallback: InlineVmEngine (node:vm runInNewContext — the script timeout
+ * kills PRE-await synchronous busy-loops; a POST-await busy loop blocks the
+ * host event loop irrecoverably, documented — prefer worker/auto).
+ */
+import type { PtcBridge, PtcEngine, PtcEngineName } from "./contract.js";
+export declare class InlineSequentialEngine implements PtcEngine {
+    readonly name: PtcEngineName;
+    run(program: string, bridge: PtcBridge, signal: AbortSignal): Promise<unknown>;
+}
+export declare class WorkerEngine implements PtcEngine {
+    readonly name: PtcEngineName;
+    run(program: string, bridge: PtcBridge, signal: AbortSignal): Promise<unknown>;
+}
+export declare class InlineVmEngine implements PtcEngine {
+    readonly name: PtcEngineName;
+    /** Script execution timeout in ms (kills pre-await synchronous
+     *  busy-loops).  Injectable so tests can pin the kill fast. */
+    private readonly compileTimeoutMs;
+    constructor(compileTimeoutMs?: number);
+    run(program: string, bridge: PtcBridge, signal: AbortSignal): Promise<unknown>;
+}
+//# sourceMappingURL=engines.d.ts.map

package/dist/tm/ptc/engines.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engines.d.ts","sourceRoot":"","sources":["../../../src/tm/ptc/engines.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAiC,MAAM,eAAe,CAAA;AAYvG,qBAAa,sBAAuB,YAAW,SAAS;IACtD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAW;IACjC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;CAyBrF;AAID,qBAAa,YAAa,YAAW,SAAS;IAC5C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAW;IAEjC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;CA8GrF;AAID,qBAAa,cAAe,YAAW,SAAS;IAC9C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAW;IACvC;mEAC+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAQ;gBAC7B,gBAAgB,SAAS;IAI/B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;CAuBrF"}

package/dist/tm/ptc/engines.js

@@ -0,0 +1,201 @@
+/**
+ * tm_ptc_run — the three engines behind the frozen `PtcEngine` seam.
+ * Split out of the former monolithic ptc.ts; behavior unchanged.
+ *
+ * M1 legacy: InlineSequentialEngine (test-only — runs on the MAIN thread,
+ * no sandbox, no timeout; a post-await busy loop blocks the host event loop
+ * irrecoverably).
+ * M2 primary: WorkerEngine (worker_threads + MessagePort RPC, env:{},
+ * resourceLimits, hard `terminate()` wall-clock kill; bootstrap as a
+ * build-time string, strict-mode program body).
+ * M2 fallback: InlineVmEngine (node:vm runInNewContext — the script timeout
+ * kills PRE-await synchronous busy-loops; a POST-await busy loop blocks the
+ * host event loop irrecoverably, documented — prefer worker/auto).
+ */
+import * as vm from "node:vm";
+import { PtcStopSignal } from "./contract.js";
+/** Build the `tm` facade the program body sees (one method per bridge tool). */
+function makeFacade(bridge) {
+    const one = (tool) => (args) => bridge.call(tool, args && typeof args === "object" ? args : {});
+    return { read: one("tm_read"), grep: one("tm_grep"), bash: one("tm_bash"), fetch: one("tm_fetch") };
+}
+export class InlineSequentialEngine {
+    name = "inline";
+    async run(program, bridge, signal) {
+        // M1 legacy engine, kept test-only: the program runs as a trusted async
+        // function body on the MAIN thread — no sandbox, no timeout, and a
+        // post-await busy loop blocks the host event loop irrecoverably (same
+        // residual as InlineVmEngine).  Production runs WorkerEngine (auto
+        // default) or InlineVmEngine.
+        const AsyncFunction = Object.getPrototypeOf(async function () { }).constructor;
+        const tm = makeFacade(bridge);
+        let abortHandler;
+        const abortP = new Promise((_, rej) => {
+            // The driver only aborts on wall-clock timeout (budget stops flow through
+            // the gate as PtcStopSignal).
+            abortHandler = () => rej(new PtcStopSignal("timeout"));
+            if (signal.aborted)
+                abortHandler();
+            else
+                signal.addEventListener("abort", abortHandler, { once: true });
+        });
+        try {
+            const fn = new AsyncFunction("tm", `"use strict";\n${program}`);
+            return await Promise.race([fn(tm), abortP]);
+        }
+        finally {
+            if (abortHandler)
+                signal.removeEventListener("abort", abortHandler);
+        }
+    }
+}
+// ---------- worker engine (MessagePort RPC over worker_threads) --------------
+export class WorkerEngine {
+    name = "worker";
+    async run(program, bridge, signal) {
+        const { Worker } = await import("node:worker_threads");
+        // Build the worker bootstrap source as a regular string (ts-safe).
+        // The worker receives {program, startDeadlineMs} via its first message,
+        // creates the tm facade, runs the program, and sends RPC call requests
+        // back to the driver which executes them through the gate bridge.
+        const src = [
+            '"use strict";',
+            'const { parentPort } = require("node:worker_threads");',
+            "parentPort.on(" + JSON.stringify("message") + ", async function onMsg(msg) {",
+            "  if (msg && msg.t === " + JSON.stringify("run") + ") {",
+            "    const program = msg.program;",
+            "    const AsyncFunction = Object.getPrototypeOf(async function(){}).constructor;",
+            "    const callMap = new Map();",
+            "    let nextId = 0;",
+            '    const one = function(tool) { return function(args) { return new Promise(function(resolve, reject) {',
+            "      const id = nextId++;",
+            "      callMap.set(id, { resolve: resolve, reject: reject });",
+            '      parentPort.postMessage({ t: "call", id: id, tool: tool, args: args || {} });',
+            "    }); }; };",
+            "    var tm = { read: one(" + JSON.stringify("tm_read") + "), grep: one(" + JSON.stringify("tm_grep") + "), bash: one(" + JSON.stringify("tm_bash") + "), fetch: one(" + JSON.stringify("tm_fetch") + ") };",
+            '    parentPort.on("message", function(inner) {',
+            '      if (inner && inner.t === "result" && callMap.has(inner.id)) {',
+            "        callMap.get(inner.id).resolve(inner.r);",
+            "        callMap.delete(inner.id);",
+            '      } else if (inner && inner.t === "abort") {',
+            "        for (const e of callMap.values()) e.reject(new Error(" + JSON.stringify("ptc-stop:") + " + inner.reason));",
+            "        callMap.clear();",
+            "      }",
+            "    });",
+            "    try {",
+            // strict-mode body, same as the inline engines (they prefix the program
+            // with "use strict"; the worker builds the body string here)
+            "      var body = " + JSON.stringify('"use strict";\n') + " + program;",
+            "      var fn = new AsyncFunction(" + JSON.stringify("tm") + ", body);",
+            "      var result = await fn(tm);",
+            '      parentPort.postMessage({ t: "done", result: result });',
+            "    } catch (err) {",
+            '      parentPort.postMessage({ t: "error", message: err instanceof Error ? err.message : String(err), stack: err instanceof Error ? err.stack : undefined });',
+            "    }",
+            "  }",
+            "});",
+        ].join("\n");
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            const w = new Worker(src, {
+                eval: true,
+                env: {},
+                resourceLimits: { maxOldGenerationSizeMb: 128, maxYoungGenerationSizeMb: 16 },
+            });
+            function settle(fn) {
+                if (settled)
+                    return;
+                settled = true;
+                fn();
+            }
+            w.on("message", (msg) => {
+                if (!msg || settled)
+                    return;
+                if (msg.t === "done") {
+                    settle(() => {
+                        w.terminate();
+                        resolve(msg.result);
+                    });
+                }
+                else if (msg.t === "error") {
+                    settle(() => {
+                        w.terminate();
+                        const err = new Error(typeof msg.message === "string" ? msg.message : "worker error");
+                        if (typeof msg.stack === "string")
+                            err.stack = msg.stack;
+                        reject(err);
+                    });
+                }
+                else if (msg.t === "call") {
+                    // Driver executes the bridge call through the gate and replies.
+                    const req = msg;
+                    bridge
+                        .call(req.tool, req.args)
+                        .then((r) => {
+                        if (!settled) {
+                            w.postMessage({ t: "result", id: req.id, r });
+                        }
+                    })
+                        .catch(() => {
+                        if (!settled) {
+                            w.postMessage({
+                                t: "result",
+                                id: req.id,
+                                r: { ok: false, error: { tool: req.tool, phase: "execute", message: "bridge call failed" } },
+                            });
+                        }
+                    });
+                }
+            });
+            w.on("error", (err) => {
+                settle(() => reject(err instanceof Error ? err : new Error(String(err))));
+            });
+            // Wire signal abort → terminate the worker.
+            const onAbort = () => {
+                settle(() => {
+                    w.terminate().then(() => reject(new PtcStopSignal("timeout")));
+                });
+            };
+            if (signal.aborted)
+                onAbort();
+            else
+                signal.addEventListener("abort", onAbort, { once: true });
+            // Send the run request.
+            w.postMessage({ t: "run", program });
+        });
+    }
+}
+// ---------- inline-vm fallback engine (node:vm with script timeout) ----------
+export class InlineVmEngine {
+    name = "inline";
+    /** Script execution timeout in ms (kills pre-await synchronous
+     *  busy-loops).  Injectable so tests can pin the kill fast. */
+    compileTimeoutMs;
+    constructor(compileTimeoutMs = 30_000) {
+        this.compileTimeoutMs = compileTimeoutMs;
+    }
+    async run(program, bridge, signal) {
+        const tm = makeFacade(bridge);
+        let abortHandler;
+        const abortP = new Promise((_, rej) => {
+            abortHandler = () => rej(new PtcStopSignal("timeout"));
+            if (signal.aborted)
+                abortHandler();
+            else
+                signal.addEventListener("abort", abortHandler, { once: true });
+        });
+        try {
+            // The async-IIFE is the program wrapper: `return` stays legal in the
+            // body, the `tm` facade rides the context globals, and the script's
+            // completion value IS the program's promise.  The timeout kills
+            // pre-await synchronous busy-loops (see the module doc).
+            const promise = vm.runInNewContext(`(async () => {\n"use strict";\n${program}\n})()`, { tm }, { timeout: this.compileTimeoutMs });
+            return await Promise.race([promise, abortP]);
+        }
+        finally {
+            if (abortHandler)
+                signal.removeEventListener("abort", abortHandler);
+        }
+    }
+}
+//# sourceMappingURL=engines.js.map