gate-evm-tools 1.0.27 → 1.0.31

package/runtime/workflow/lib/planCli.ts

@@ -0,0 +1,279 @@
+import fs from "fs";
+import path from "path";
+import {
+  PLAN_FILE,
+  assertPortableInput,
+  emptyPlan,
+  parsePlan,
+  planSummary,
+  readPlanFile,
+  renderPlan,
+  type Plan,
+  type PlanSection,
+  type PlanTask,
+} from "./plan";
+
+/**
+ * `plan-read` / `plan-write` / `plan-add`.
+ *
+ * The three exist so the plan never has to be hand-written. In a document that
+ * two runtimes both produce and consume, the fields most likely to be wrong are
+ * exactly the mechanical ones -- revision accounting, the section headings, the
+ * block syntax, the forbidden-field rules -- and those are the ones a command
+ * can own outright. The LLM's job is the objective and the acceptance criteria;
+ * the file's shape is not its job.
+ */
+
+const parseArgs = (argv: string[]): Map<string, string> => {
+  const values = new Map<string, string>();
+  for (let index = 0; index < argv.length; index += 1) {
+    const item = argv[index];
+    if (!item.startsWith("--")) continue;
+    const equalAt = item.indexOf("=");
+    const key = item.slice(2, equalAt > 2 ? equalAt : undefined);
+    const next = argv[index + 1];
+    // A trailing flag with no value is a switch, not a malformed option.
+    if (equalAt < 0 && (!next || next.startsWith("--"))) {
+      values.set(key, "true");
+      continue;
+    }
+    const value = equalAt > 2 ? item.slice(equalAt + 1) : next;
+    if (!value || value.startsWith("--")) throw new Error(`--${key} requires a value`);
+    if (values.has(key)) throw new Error(`--${key} may be provided only once`);
+    values.set(key, value.trim());
+    if (equalAt < 0) index += 1;
+  }
+  return values;
+};
+
+const readJsonInput = (values: Map<string, string>, root: string): unknown => {
+  const inline = values.get("input");
+  const file = values.get("inputFile");
+  if (inline && file) throw new Error("--input and --inputFile are mutually exclusive");
+  if (file) {
+    const absolute = path.isAbsolute(file) ? file : path.join(root, file);
+    if (!fs.existsSync(absolute)) throw new Error(`--inputFile not found: ${file}`);
+    return JSON.parse(fs.readFileSync(absolute, "utf8"));
+  }
+  if (inline) return JSON.parse(inline);
+  throw new Error("--input or --inputFile is required");
+};
+
+const asRecord = (value: unknown, label: string): Record<string, unknown> => {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be a JSON object`);
+  }
+  return value as Record<string, unknown>;
+};
+
+const parseSections = (value: unknown): Record<PlanSection, "enabled" | "disabled"> => {
+  const record = value === undefined ? {} : asRecord(value, "sections");
+  const read = (key: PlanSection, fallback: "enabled" | "disabled") => {
+    const raw = record[key] ?? fallback;
+    if (raw !== "enabled" && raw !== "disabled") {
+      throw new Error(`sections.${key} must be "enabled" or "disabled"`);
+    }
+    return raw;
+  };
+  return {
+    development: read("development", "enabled"),
+    audit: read("audit", "enabled"),
+    deployment: read("deployment", "enabled"),
+  };
+};
+
+/** A task from the caller, without the fields the writer owns. */
+const toTask = (value: unknown, where: string): PlanTask => {
+  const record = asRecord(value, where);
+  return {
+    planKey: String(record.planKey ?? ""),
+    title: String(record.title ?? ""),
+    objective: String(record.objective ?? ""),
+    acceptance: Array.isArray(record.acceptance) ? record.acceptance.map(String) : [],
+    dependsOn: Array.isArray(record.dependsOn) ? record.dependsOn.map(String) : [],
+    status: (record.status ?? "pending") as PlanTask["status"],
+    ...(record.scope !== undefined ? { scope: asRecord(record.scope, `${where}.scope`) } : {}),
+    ...(record.parameters !== undefined
+      ? { parameters: (() => {
+        if (!Array.isArray(record.parameters)) throw new Error(`${where}.parameters must be an array`);
+        return record.parameters;
+      })() }
+      : {}),
+    ...(record.expectedArtifacts !== undefined
+      ? { expectedArtifacts: (record.expectedArtifacts as unknown[]).map(String) }
+      : {}),
+    ...(record.allowedChanges !== undefined
+      ? { allowedChanges: (record.allowedChanges as unknown[]).map(String) }
+      : {}),
+  };
+};
+
+const sectionOf = (value: unknown): PlanSection => {
+  const section = String(value ?? "development");
+  if (section !== "development" && section !== "audit" && section !== "deployment") {
+    throw new Error(`--section must be development, audit or deployment (got "${section}")`);
+  }
+  return section;
+};
+
+export const runPlanReadCli = (argv: string[], root: string = process.cwd()): Record<string, unknown> => {
+  const values = parseArgs(argv);
+  const plan = readPlanFile(root, values.get("path") || PLAN_FILE);
+  return values.has("full")
+    ? { ...planSummary(plan), plan: renderPlan(plan) }
+    : planSummary(plan);
+};
+
+/**
+ * Replace the plan. `revision` is not taken from the caller: the writer owns it,
+ * because it is the one number every consumer depends on and the one easiest to
+ * get wrong by hand. It advances only when the execution contract changes.
+ */
+export const runPlanWriteCli = (argv: string[], root: string = process.cwd()): Record<string, unknown> => {
+  const values = parseArgs(argv);
+  const input = asRecord(readJsonInput(values, root), "--input");
+  assertPortableInput(input, "--input");
+  const relative = values.get("path") || PLAN_FILE;
+  const sections = parseSections(input.sections);
+  const tasksInput = input.tasks;
+  const tasks: Record<PlanSection, PlanTask[]> = { development: [], audit: [], deployment: [] };
+  if (tasksInput !== undefined) {
+    const record = asRecord(tasksInput, "tasks");
+    for (const section of ["development", "audit", "deployment"] as const) {
+      const list = record[section];
+      if (list === undefined) continue;
+      if (!Array.isArray(list)) throw new Error(`tasks.${section} must be an array`);
+      tasks[section] = list.map((item, index) => toTask(item, `tasks.${section}[${index}]`));
+    }
+  }
+
+  const existing = fs.existsSync(path.join(root, relative)) ? readPlanFile(root, relative) : undefined;
+
+  const previousContracts = existing
+    ? new Map((["development", "audit", "deployment"] as const)
+      .flatMap((section) => existing.tasks[section])
+      .map((task) => [task.planKey, contractOf(task)]))
+    : new Map<string, string>();
+  const nextAll = (["development", "audit", "deployment"] as const).flatMap((section) => tasks[section]);
+  let revision = existing ? existing.revision : 1;
+  if (existing) {
+    const changed = nextAll.length !== previousContracts.size
+      || nextAll.some((task) => previousContracts.get(task.planKey) !== contractOf(task))
+      || JSON.stringify(existing.sections) !== JSON.stringify(sections);
+    if (changed) revision = existing.revision + 1;
+  }
+
+  const plan: Plan = {
+    schema: "gateflow-plan/v1",
+    taskId: String(input.taskId ?? existing?.taskId ?? ""),
+    revision,
+    title: String(input.title ?? existing?.title ?? ""),
+    sections,
+    updatedAt: new Date().toISOString(),
+    tasks,
+  };
+  // The writer is the one place the document is produced, so the whole plan is
+  // validated on the way out -- same checks an import would run.
+  const text = renderPlan(plan);
+  const validated = parsePlan(text);
+  fs.mkdirSync(path.dirname(path.join(root, relative)), { recursive: true });
+  fs.writeFileSync(path.join(root, relative), text);
+
+  const added = nextAll.filter((task) => !previousContracts.has(task.planKey)).map((task) => task.planKey);
+  const removed = [...previousContracts.keys()].filter((key) => !nextAll.some((task) => task.planKey === key));
+  return {
+    ...planSummary(validated),
+    path: relative,
+    revisionBumped: !existing || revision !== existing.revision,
+    added,
+    // Reported, never silently applied: dropping a task from the file makes it
+    // look like it never existed to the other entry point.
+    removed,
+    ...(removed.length > 0
+      ? { warning: `tasks were dropped from the plan: ${removed.join(", ")}. Cancelling (status=cancelled) is usually what you want instead.` }
+      : {}),
+  };
+};
+
+/** Append one task, advancing the revision. The common case, so it gets a verb. */
+export const runPlanAddCli = (argv: string[], root: string = process.cwd()): Record<string, unknown> => {
+  const values = parseArgs(argv);
+  const input = asRecord(readJsonInput(values, root), "--input");
+  assertPortableInput(input, "--input");
+  const relative = values.get("path") || PLAN_FILE;
+  const plan = readPlanFile(root, relative);
+  const section = sectionOf(input.section);
+  const task = toTask(input.task ?? input, "task");
+  if (plan.sections[section] === "disabled") {
+    throw new Error(`section "${section}" is disabled; enable it before adding tasks`);
+  }
+  const existingKeys = (["development", "audit", "deployment"] as const)
+    .flatMap((item) => plan.tasks[item])
+    .map((item) => item.planKey);
+  if (existingKeys.includes(task.planKey)) {
+    throw new Error(`planKey "${task.planKey}" already exists; plan keys are stable identities, not labels`);
+  }
+  const next: Plan = {
+    ...plan,
+    revision: plan.revision + 1,
+    updatedAt: new Date().toISOString(),
+    tasks: { ...plan.tasks, [section]: [...plan.tasks[section], task] },
+  };
+  const text = renderPlan(next);
+  parsePlan(text);
+  fs.writeFileSync(path.join(root, relative), text);
+  return { ...planSummary(next), path: relative, section, added: task.planKey };
+};
+
+export const contractOf = (task: PlanTask): string => JSON.stringify({
+  objective: task.objective,
+  acceptance: task.acceptance,
+  dependsOn: task.dependsOn,
+  scope: task.scope ?? null,
+  parameters: task.parameters ?? null,
+  expectedArtifacts: task.expectedArtifacts ?? null,
+  allowedChanges: task.allowedChanges ?? null,
+});
+
+/**
+ * Status moves the protocol allows. Progress is not a contract change, so it
+ * never advances the revision -- otherwise every completed task would look
+ * like a re-plan to the other entry point.
+ */
+const STATUS_MOVES: Record<PlanTask["status"], readonly PlanTask["status"][]> = {
+  pending: ["ready", "running", "cancelled"],
+  ready: ["running", "cancelled"],
+  running: ["completed", "failed"],
+  failed: ["ready", "running", "cancelled"],
+  completed: ["pending"],
+  cancelled: [],
+};
+
+/** Move one task's status: `--task <planKey> --to <status>`. */
+export const runPlanStatusCli = (argv: string[], root: string = process.cwd()): Record<string, unknown> => {
+  const values = parseArgs(argv);
+  const relative = values.get("path") || PLAN_FILE;
+  const planKey = values.get("task");
+  const to = values.get("to") as PlanTask["status"] | undefined;
+  if (!planKey) throw new Error("--task <planKey> is required");
+  if (!to || !(to in STATUS_MOVES)) throw new Error(`--to must be one of ${Object.keys(STATUS_MOVES).join(", ")}`);
+  const plan = readPlanFile(root, relative);
+  const all = (["development", "audit", "deployment"] as const).flatMap((section) => plan.tasks[section]);
+  const task = all.find((item) => item.planKey === planKey);
+  if (!task) throw new Error(`task "${planKey}" not found`);
+  const from = task.status;
+  if (from === to) return { ...planSummary(plan), path: relative, planKey, from, to, changed: false };
+  if (!STATUS_MOVES[from].includes(to)) throw new Error(`task "${planKey}" cannot move from ${from} to ${to}`);
+  if (to === "running") {
+    const blocked = task.dependsOn.filter((key) => all.find((item) => item.planKey === key)?.status !== "completed");
+    if (blocked.length > 0) throw new Error(`task "${planKey}" depends on unfinished task(s): ${blocked.join(", ")}`);
+  }
+  task.status = to;
+  const next: Plan = { ...plan, updatedAt: new Date().toISOString() };
+  const text = renderPlan(next);
+  parsePlan(text);
+  fs.writeFileSync(path.join(root, relative), text);
+  return { ...planSummary(next), path: relative, planKey, from, to, changed: true };
+};
+
+export { emptyPlan };

package/runtime/workflow/lib/preparationEvidence.ts

@@ -0,0 +1,14 @@
+import path from 'node:path';
+import type { WorkflowContext } from './context';
+import type { DeploymentChange } from './deploymentRecords';
+import type { PreparedGateToolWorkflow } from './gateTool';
+export function recordPreparedDeployment(context: WorkflowContext, change: DeploymentChange, prepared: PreparedGateToolWorkflow, derivedKeys: string[]): void {
+  if (!context.preparations) return;
+  const ref = (file: string) => path.isAbsolute(file) ? path.relative(context.root, file).split(path.sep).join('/') : file;
+  const planPath = ref(prepared.planPath);
+  // Step structs use optional undefined properties; immutable journal input is explicit JSON data.
+  const clean = Object.fromEntries(Object.entries(change).filter(([, value]) => value !== undefined));
+  clean.gateTool = { outputPath: planPath, data: prepared.plan };
+  context.preparations.prepare({ stepId: change.stepId, change: clean as unknown as DeploymentChange,
+    prepared: { ...prepared, requestPath: ref(prepared.requestPath), planPath }, derivedKeys });
+}

package/runtime/workflow/lib/proxy.ts

@@ -1,5 +1,5 @@
 import { keccak256, toUtf8Bytes } from "ethers";
-import { ethers } from "../../projectHardhat";
+import type { Provider } from "ethers";
 import {
   getERC1967Admin,
   getERC1967Implementation,
@@ -31,9 +31,10 @@ export const deriveImplementationSalt = (
 );
 
 export const getImplementationAddress = async (
+  provider: Pick<Provider, "getStorage">,
   proxyAddress: string,
 ): Promise<string> => {
-  const implementation = await getERC1967Implementation(ethers.provider, proxyAddress);
+  const implementation = await getERC1967Implementation(provider, proxyAddress);
   if (!implementation) {
     throw new Error(`Proxy ${proxyAddress} has no ERC-1967 implementation`);
   }
@@ -41,5 +42,6 @@ export const getImplementationAddress = async (
 };
 
 export const getProxyAdminAddress = async (
+  provider: Pick<Provider, "getStorage">,
   proxyAddress: string,
-): Promise<string | undefined> => getERC1967Admin(ethers.provider, proxyAddress);
+): Promise<string | undefined> => getERC1967Admin(provider, proxyAddress);

package/runtime/workflow/lib/runtime.ts

@@ -0,0 +1,46 @@
+import type { Signer } from "ethers";
+import type { WorkflowHre, WorkflowRuntime } from "./context";
+
+export const assertLocalForkHre = (hre: WorkflowHre): void => {
+  if (hre.network.name !== "hardhat" && hre.network.name !== "zkFork") {
+    throw new Error("Simulation requires an explicit local fork network");
+  }
+  const url = (hre.network.config as { url?: string }).url;
+  if (url !== undefined) {
+    let parsed: URL;
+    try { parsed = new URL(url); } catch { throw new Error("Local fork RPC must use a loopback URL"); }
+    if (
+      parsed.protocol !== "http:"
+      || !["127.0.0.1", "localhost", "[::1]"].includes(parsed.hostname)
+      || parsed.username || parsed.password
+    ) {
+      throw new Error("Local fork RPC must use a loopback URL");
+    }
+  }
+};
+
+export const assertLocalForkRuntime = (runtime: WorkflowRuntime): void => {
+  if (!runtime?.hre || !runtime.localFork) {
+    throw new Error("Simulation requires an explicit local fork capability");
+  }
+  assertLocalForkHre(runtime.hre);
+  if (runtime.localFork.provider !== runtime.hre.network.provider) {
+    throw new Error("Simulation local fork capability does not match the runtime provider");
+  }
+};
+
+export const assertLocalForkSigner = (runtime: WorkflowRuntime, signer: Signer): void => {
+  if (signer.provider !== runtime.hre.ethers.provider) {
+    throw new Error("Simulation signer must be connected to the explicit local fork provider");
+  }
+};
+
+export const impersonateLocalForkSigner = async (
+  runtime: WorkflowRuntime,
+  address: string,
+): Promise<Signer> => {
+  assertLocalForkRuntime(runtime);
+  const signer = await runtime.localFork!.impersonate(address);
+  assertLocalForkSigner(runtime, signer);
+  return signer;
+};

package/runtime/workflow/lib/signer.ts

@@ -6,7 +6,8 @@ import {
   createZkSyncSigner,
   resolveWalletCredential,
 } from "gate-evm-tools/custody";
-import { ethers, network } from "../../projectHardhat";
+import type { WorkflowHre } from "./context";
+import { assertLocalForkHre } from "./runtime";
 import { assertExecutionSignerAddress } from "./signerIdentity";
 import type { WorkflowMode } from "./simulation";
 
@@ -47,11 +48,11 @@ export const resolveSimulationSignerAddress = (options: WorkflowSignerOptions):
 };
 
 export const impersonateWorkflowSimulationSigner = async (
+  hre: WorkflowHre,
   signerAddress: string,
 ): Promise<Signer> => {
-  if (network.name !== "hardhat" && network.name !== "zkFork") {
-    throw new Error("Simulation signer impersonation requires a local fork network");
-  }
+  assertLocalForkHre(hre);
+  const { ethers, network } = hre;
   await network.provider.request({
     method: "hardhat_impersonateAccount",
     params: [signerAddress],
@@ -70,11 +71,13 @@ export const impersonateWorkflowSimulationSigner = async (
 };
 
 export const resolveWorkflowSigner = async (
+  hre: WorkflowHre,
   mode: WorkflowMode,
   options: WorkflowSignerOptions = {},
 ): Promise<Signer> => {
+  const { ethers, network } = hre;
   if (mode === "simulate") {
-    return impersonateWorkflowSimulationSigner(resolveSimulationSignerAddress(options));
+    return impersonateWorkflowSimulationSigner(hre, resolveSimulationSignerAddress(options));
   }
 
   const executionCredential = mode === "execute"

package/runtime/workflow/lib/simulation.ts

@@ -1,5 +1,8 @@
 import { isAddress } from "ethers";
-import { config as hardhatConfig, ethers, network } from "../../projectHardhat";
+import type { Provider } from "ethers";
+import type { WorkflowHre } from "./context";
+import { assertLocalForkHre } from "./runtime";
+import { isAllowedSourceRpcMethod } from "./sourceRpcPolicy";
 import {
   CapturedChainSnapshotV1,
   ForkSnapshotV1,
@@ -15,6 +18,7 @@ export type WorkflowMode = "execute" | "simulate" | "verify";
 
 export interface SimulationFork {
   snapshot?: ForkSnapshotV1;
+  sourceRpcUrl?: string;
 }
 
 type WithoutVersion<T> = T extends unknown ? Omit<T, "version"> : never;
@@ -43,8 +47,8 @@ export const resolveWorkflowMode = (
   return mode;
 };
 
-const sourceProxyUrl = (): string => {
-  const value = process.env.GATE_SIMULATION_SOURCE_RPC_URL?.trim();
+const sourceProxyUrl = (sourceRpcUrl: string | undefined): string => {
+  const value = sourceRpcUrl?.trim();
   if (!value) throw new Error("Simulation source-chain proxy URL is missing");
   let parsed: URL;
   try {
@@ -72,6 +76,7 @@ const rpcRequest = async <T>(
   method: string,
   params: unknown[],
 ): Promise<T> => {
+  if (!isAllowedSourceRpcMethod(method)) throw new Error(`Source RPC method is not read-only: ${method}`);
   let response: Response;
   try {
     response = await fetch(url, {
@@ -148,6 +153,7 @@ const requiredInfrastructureAddress = (
 };
 
 export const assertCurrentStateInfrastructure = async (
+  provider: Pick<Provider, "getCode" | "getStorage">,
   targetId: string,
   target: SimulationInfrastructureTarget,
   snapshot: CapturedChainSnapshotV1 | undefined,
@@ -174,7 +180,7 @@ export const assertCurrentStateInfrastructure = async (
     },
   ];
   const code = await Promise.all(infrastructure.map((entry) => (
-    ethers.provider.getCode(entry.address, snapshot.blockNumber)
+    provider.getCode(entry.address, snapshot.blockNumber)
   )));
   for (const [index, entry] of infrastructure.entries()) {
     if (!code[index] || code[index] === "0x") {
@@ -186,19 +192,21 @@ export const assertCurrentStateInfrastructure = async (
 };
 
 export const assertSimulationSourceInfrastructure = async (
+  provider: Pick<Provider, "getCode" | "getStorage">,
   targetId: string,
   target: SimulationInfrastructureTarget,
   simulation: SimulationFork,
-): Promise<void> => assertCurrentStateInfrastructure(targetId, target, simulation.snapshot);
+): Promise<void> => assertCurrentStateInfrastructure(provider, targetId, target, simulation.snapshot);
 
 export const assertCurrentStateUupsSourceState = async (
+  provider: Pick<Provider, "getCode" | "getStorage">,
   snapshot: CapturedChainSnapshotV1 | undefined,
   proxy: string,
 ): Promise<void> => {
   if (!snapshot) return;
   const [proxyCode, oldImplementation] = await Promise.all([
-    ethers.provider.getCode(proxy, snapshot.blockNumber),
-    getERC1967Implementation(ethers.provider, proxy, snapshot.blockNumber),
+    provider.getCode(proxy, snapshot.blockNumber),
+    getERC1967Implementation(provider, proxy, snapshot.blockNumber),
   ]);
   if (!proxyCode || proxyCode === "0x") {
     throw new Error(
@@ -210,7 +218,7 @@ export const assertCurrentStateUupsSourceState = async (
       `UUPS proxy ${proxy} has no implementation at captured block ${snapshot.blockNumber}`,
     );
   }
-  const implementationCode = await ethers.provider.getCode(
+  const implementationCode = await provider.getCode(
     oldImplementation,
     snapshot.blockNumber,
   );
@@ -222,18 +230,22 @@ export const assertCurrentStateUupsSourceState = async (
 };
 
 export const assertSimulationUupsSourceState = async (
+  provider: Pick<Provider, "getCode" | "getStorage">,
   simulation: SimulationFork,
   proxy: string,
-): Promise<void> => assertCurrentStateUupsSourceState(simulation.snapshot, proxy);
+): Promise<void> => assertCurrentStateUupsSourceState(provider, simulation.snapshot, proxy);
 
 export const verifySimulationForkSnapshot = async (
+  hre: WorkflowHre,
   simulation: SimulationFork,
 ): Promise<void> => {
+  assertLocalForkHre(hre);
+  const { network } = hre;
   const snapshot = simulation.snapshot;
   if (!snapshot) return;
   const [sourceBlock, localBlock, sourceZkSyncBlockDetails] = await Promise.all([
     rpcRequest<unknown>(
-      sourceProxyUrl(),
+      sourceProxyUrl(simulation.sourceRpcUrl),
       "eth_getBlockByNumber",
       [blockTag(snapshot.blockNumber), false],
     ),
@@ -243,7 +255,7 @@ export const verifySimulationForkSnapshot = async (
     }),
     snapshot.runner.kind === "anvil-zksync"
       ? rpcRequest<unknown>(
-          sourceProxyUrl(),
+          sourceProxyUrl(simulation.sourceRpcUrl),
           "zks_getBlockDetails",
           [snapshot.blockNumber],
         )
@@ -307,7 +319,19 @@ export const simulationForkEvidence = (
   };
 };
 
-export const setupSimulationFork = async (targetId: string): Promise<SimulationFork> => {
+export interface SimulationForkOptions {
+  snapshotJson?: string;
+  sourceRpcUrl?: string;
+}
+
+// Legacy/launcher helper. The shared step engine never resets or launches a fork.
+export const setupSimulationFork = async (
+  hre: WorkflowHre,
+  targetId: string,
+  options: SimulationForkOptions,
+): Promise<SimulationFork> => {
+  assertLocalForkHre(hre);
+  const { config: hardhatConfig, network } = hre;
   const targetNetwork = (
     hardhatConfig.networks as Record<string, { zksync?: boolean }>
   )[targetId];
@@ -321,7 +345,7 @@ export const setupSimulationFork = async (targetId: string): Promise<SimulationF
       );
     }
     const snapshot = parseForkSnapshotJson(
-      process.env.GATE_SIMULATION_FORK_SNAPSHOT_JSON,
+      options.snapshotJson,
       targetId,
     );
     if (
@@ -353,7 +377,7 @@ export const setupSimulationFork = async (targetId: string): Promise<SimulationF
       );
     }
     assertBlockHash(forkBlock, snapshot, "Local EraVM");
-    return { snapshot };
+    return { snapshot, sourceRpcUrl: sourceProxyUrl(options.sourceRpcUrl) };
   }
   if (network.name !== "hardhat") {
     throw new Error("Simulation mode must run with --network hardhat");
@@ -362,13 +386,13 @@ export const setupSimulationFork = async (targetId: string): Promise<SimulationF
     return {};
   }
   const snapshot = parseForkSnapshotJson(
-    process.env.GATE_SIMULATION_FORK_SNAPSHOT_JSON,
+    options.snapshotJson,
     targetId,
   );
   if (snapshot.runner.kind !== "hardhat") {
     throw new Error(`EVM target "${targetId}" requires a Hardhat fork snapshot`);
   }
-  const forkRpcUrl = sourceProxyUrl();
+  const forkRpcUrl = sourceProxyUrl(options.sourceRpcUrl);
   const sourceBlock = await rpcRequest<unknown>(
     forkRpcUrl,
     "eth_getBlockByNumber",
@@ -411,5 +435,5 @@ export const setupSimulationFork = async (targetId: string): Promise<SimulationF
     params: ["0x1"],
   });
 
-  return { snapshot };
+  return { snapshot, sourceRpcUrl: sourceProxyUrl(options.sourceRpcUrl) };
 };

package/runtime/workflow/lib/state.ts

@@ -1,5 +1,5 @@
 export class WorkflowState {
-  private readonly values: Record<string, unknown> = {};
+  private readonly values: Record<string, unknown> = Object.create(null);
 
   set(key: string, value: unknown): void {
     this.values[key] = value;
@@ -10,7 +10,7 @@ export class WorkflowState {
     let current: unknown = this.values;
 
     for (const part of parts) {
-      if (typeof current !== "object" || current === null || !(part in current)) {
+      if (typeof current !== "object" || current === null || !Object.hasOwn(current, part)) {
         throw new Error(`State reference not found: state.${pathExpression}`);
       }
       current = (current as Record<string, unknown>)[part];
@@ -20,6 +20,6 @@ export class WorkflowState {
   }
 
   snapshot(): Record<string, unknown> {
-    return { ...this.values };
+    return Object.assign(Object.create(null), this.values);
   }
 }