pi-subagents 0.83.0 → 0.84.0

package/workflow-script-worker.cjs

@@ -1,3 +1,5 @@
+"use strict";
+
 const { parentPort, workerData } = require("node:worker_threads");
 const vm = require("node:vm");
 const { inspect } = require("node:util");
@@ -18,6 +20,72 @@ function createWorkflowPromiseHook(callbacks) {
   }
 }
 
+// Workflow scripts run in their own vm context (the script realm). The API a script can reach (runs,
+// state, emit, console, Promise, results, errors) is built by workflowRuntime inside a second vm
+// context (the runtime realm), compiled from this function's source. Neither realm can compile code
+// from strings, and no worker-realm object may ever become reachable from either: one would hand the
+// script the worker's Function, and with it process. The runtime talks to the worker only through
+// `bridge`, which it keeps in this closure, passes only strings and numbers, and calls in try/catch.
+// Engine paths can still throw a worker-realm error into script code (a stack overflow inside Node's
+// stack formatter, for one), so lockWorkerRealm also makes every worker value useless before a script runs.
+function workflowRuntime(bridge, scriptRealm, stateEnabled) {
+"use strict";
+
+// Promise hooks report every promise in the isolate, the worker's own included. Captured before any
+// script runs, so a script that replaces Object.getPrototypeOf cannot receive a worker promise.
+const getPrototypeOf = Object.getPrototypeOf;
+const runtimePromisePrototype = Promise.prototype;
+const nativePromisePrototype = scriptRealm.promisePrototype;
+
+function isWorkflowRealmPromise(value) {
+  if (!value || typeof value !== "object") return false;
+  let prototype = getPrototypeOf(value);
+  for (let depth = 0; prototype && depth < 16; depth++) {
+    if (prototype === nativePromisePrototype || prototype === runtimePromisePrototype) return true;
+    prototype = getPrototypeOf(prototype);
+  }
+  return false;
+}
+
+function post(message) {
+  const json = JSON.stringify(message);
+  let posted = false;
+  try {
+    posted = bridge.post(json);
+  } catch {}
+  if (posted !== true) throw new Error("Workflow runtime could not send a message to the host.");
+}
+
+function inspectValue(value) {
+  let encoded;
+  try {
+    encoded = bridge.inspect(value);
+  } catch {}
+  if (typeof encoded !== "string") throw new Error("console could not format a value.");
+  const decoded = JSON.parse(encoded);
+  if (decoded[0] !== true) throw new Error(String(decoded[1]));
+  return decoded[1];
+}
+
+function utf8ByteLength(value) {
+  if (typeof value !== "string") throw new TypeError("Expected a string to measure.");
+  let length;
+  try {
+    length = bridge.utf8Length(value);
+  } catch {}
+  if (typeof length !== "number" || length < 0) throw new Error("Workflow runtime could not measure a string.");
+  return length;
+}
+
+function utf8Prefix(value, maxBytes) {
+  let prefix;
+  try {
+    prefix = bridge.utf8Prefix(value, maxBytes);
+  } catch {}
+  if (typeof prefix !== "string") throw new Error("Workflow runtime could not truncate a string.");
+  return prefix;
+}
+
 let nextCallId = 0;
 let topLevelWorkflowPromise;
 let suppressNativePromiseConsumption = 0;
@@ -26,7 +94,7 @@ const pending = new Map();
 const workflowErrorKinds = new WeakMap();
 const runKeyPattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 function validGitRef(ref) {
-  if (typeof ref !== "string" || !ref || ref === "@" || new TextEncoder().encode(ref).length > 1024 || ref.startsWith("/") || ref.endsWith("/") || ref.includes("//") || ref.includes("..") || ref.includes("@{")) return false;
+  if (typeof ref !== "string" || !ref || ref === "@" || utf8ByteLength(ref) > 1024 || ref.startsWith("/") || ref.endsWith("/") || ref.includes("//") || ref.includes("..") || ref.includes("@{")) return false;
   if (/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/iu.test(ref)) return false;
   if (/[[\]\\~^:?*\u0000-\u0020\u007f]/u.test(ref) || ref.endsWith(".") || ref.endsWith(".lock")) return false;
   return ref.split("/").every((component) => component.length > 0 && component !== "." && component !== ".." && !component.startsWith(".") && !component.endsWith(".") && !component.endsWith(".lock"));
@@ -50,7 +118,13 @@ function canonicalRunParams(params) {
 }
 
 function isDirectWorkflowScriptPromiseHandlerCall() {
-  const stack = new Error().stack;
+  let stack;
+  try {
+    stack = new Error().stack;
+  } catch {
+    // Near the stack limit the host's formatter overflows and throws its own realm's RangeError.
+    return false;
+  }
   if (typeof stack !== "string") return false;
   return stack.split("\n").some((line) => line.includes("workflow-script.js") && !line.includes("at async "));
 }
@@ -122,7 +196,7 @@ function addTrackedObservations(tracker, observations) {
   for (const observation of tracker.observations) {
     if (observedCallIds.has(observation.callId)) continue;
     observedCallIds.add(observation.callId);
-    parentPort.postMessage({ type: "callObserved", callId: observation.callId, key: observation.key, operation: observation.operation });
+    post({ type: "callObserved", callId: observation.callId, key: observation.key, operation: observation.operation });
   }
 }
 
@@ -247,7 +321,7 @@ function hostCall(method, args, observation) {
   const callId = ++nextCallId;
   const promise = new Promise((resolve, reject) => {
     pending.set(callId, { resolve, reject });
-    parentPort.postMessage({ type: "call", callId, method, args });
+    post({ type: "call", callId, method, args });
   });
   return observation && typeof observation.key === "string" && typeof observation.operation === "string"
     ? trackRunObservation([{ key: observation.key, operation: observation.operation, callId }], promise)
@@ -258,7 +332,7 @@ function runHostCall(key, params, collectFailure, batch, generatedLaneKey) {
   const callId = ++nextCallId;
   const promise = new Promise((resolve, reject) => {
     pending.set(callId, { resolve, reject });
-    parentPort.postMessage({ type: "call", callId, method: "run", args: { key, params, ...(collectFailure ? { collectFailure: true } : {}), ...(batch ? { batch } : {}), ...(generatedLaneKey ? { generatedLaneKey } : {}) } });
+    post({ type: "call", callId, method: "run", args: { key, params, ...(collectFailure ? { collectFailure: true } : {}), ...(batch ? { batch } : {}), ...(generatedLaneKey ? { generatedLaneKey } : {}) } });
   });
   return { key, callId, promise };
 }
@@ -300,14 +374,13 @@ function wrapRunsAllResults(results, keys) {
 }
 
 function laneByteLength(value) {
-  return new TextEncoder().encode(value).byteLength;
+  return utf8ByteLength(value);
 }
 
 function laneBoardText(value) {
   if (typeof value !== "string" || !value) return undefined;
   if (laneByteLength(value) <= MAX_LANE_BOARD_TEXT_BYTES) return value;
-  const bytes = new TextEncoder().encode(value).subarray(0, MAX_LANE_BOARD_TEXT_BYTES - 3);
-  return new TextDecoder().decode(bytes) + "...";
+  return utf8Prefix(value, MAX_LANE_BOARD_TEXT_BYTES - 3) + "...";
 }
 
 function laneBoardPath(value) {
@@ -508,7 +581,7 @@ function workflowPlanStringMetadata(params) {
 
 function runLanes(laneSpecs) {
   const lanes = validateLaneSpecs(laneSpecs);
-  parentPort.postMessage({ type: "lanePlan", lanes: lanes.map((lane) => ({
+  post({ type: "lanePlan", lanes: lanes.map((lane) => ({
     key: lane.key,
     stages: lane.stages.map((stage) => ({
       key: stage.key,
@@ -576,7 +649,7 @@ function validateExtensionBindings(value, label) {
     }
   }
   visit(value, 0);
-  if (new TextEncoder().encode(stableRunJson(value)).byteLength > 16384) throw new Error(label + " extensionBindings canonical JSON exceeds 16384 bytes.");
+  if (utf8ByteLength(stableRunJson(value)) > 16384) throw new Error(label + " extensionBindings canonical JSON exceeds 16384 bytes.");
 }
 
 function validateLaneMetadata(value, label, workflowKey) {
@@ -590,7 +663,7 @@ function validateLaneMetadata(value, label, workflowKey) {
   if (typeof value.key !== "string" || !value.key.trim() || !runKeyPattern.test(value.key.trim())) throw new Error(label + ".key is invalid.");
   if (workflowKey !== undefined && value.key.trim() !== workflowKey) throw new Error(label + ".key must match workflow key '" + workflowKey + "'.");
   if (value.mode !== undefined && !["mutation", "review", "scout", "gate"].includes(value.mode)) throw new Error(label + ".mode is invalid.");
-  const bounded = (entry, maxBytes) => typeof entry === "string" && entry.trim() && new TextEncoder().encode(entry.trim()).byteLength <= maxBytes && !/[\r\n\u0000]/.test(entry);
+  const bounded = (entry, maxBytes) => typeof entry === "string" && entry.trim() && utf8ByteLength(entry.trim()) <= maxBytes && !/[\r\n\u0000]/.test(entry);
   if (value.sourceRef !== undefined && !bounded(value.sourceRef, 128)) throw new Error(label + ".sourceRef is invalid.");
   for (const [name, maxItems, maxLength] of [["claims", 20, 160], ["outputPaths", 10, 256]]) {
     if (value[name] === undefined) continue;
@@ -682,11 +755,11 @@ function validateHostCommand(key, params) {
     throw new Error("runs.host('" + key + "') params have unsupported fields: " + unknown.join(", ") + "." + cwdHint);
   }
   if (params.kind !== "command") throw new Error("runs.host('" + key + "') kind must be 'command'.");
-  if (typeof params.command !== "string" || !params.command.trim() || params.command.includes("\u0000") || new TextEncoder().encode(params.command.trim()).byteLength > 16384) throw new Error("runs.host('" + key + "') command must be a non-empty string of at most 16384 bytes without NUL.");
+  if (typeof params.command !== "string" || !params.command.trim() || params.command.includes("\u0000") || utf8ByteLength(params.command.trim()) > 16384) throw new Error("runs.host('" + key + "') command must be a non-empty string of at most 16384 bytes without NUL.");
   if (!Number.isInteger(params.timeoutMs) || params.timeoutMs < 1 || params.timeoutMs > 86400000) throw new Error("runs.host('" + key + "') timeoutMs must be an integer from 1 to 86400000.");
-  if (params.output !== undefined && (typeof params.output !== "string" || !params.output.trim() || /^[/\\]|(?:^|[/\\])\.\.(?:[/\\]|$)/.test(params.output) || /[\u0000-\u001f\u007f]/.test(params.output) || new TextEncoder().encode(params.output.trim()).byteLength > 240)) throw new Error("runs.host('" + key + "') output must be a bounded relative path without traversal or control characters.");
+  if (params.output !== undefined && (typeof params.output !== "string" || !params.output.trim() || /^[/\\]|(?:^|[/\\])\.\.(?:[/\\]|$)/.test(params.output) || /[\u0000-\u001f\u007f]/.test(params.output) || utf8ByteLength(params.output.trim()) > 240)) throw new Error("runs.host('" + key + "') output must be a bounded relative path without traversal or control characters.");
   if (params.role !== undefined && params.role !== "ci" && params.role !== "gate") throw new Error("runs.host('" + key + "') role must be 'ci' or 'gate'.");
-  if (params.provider !== undefined && (typeof params.provider !== "string" || !params.provider.trim() || /[\r\n\u0000]/.test(params.provider) || new TextEncoder().encode(params.provider.trim()).byteLength > 64)) throw new Error("runs.host('" + key + "') provider must be a non-empty single-line string of at most 64 bytes.");
+  if (params.provider !== undefined && (typeof params.provider !== "string" || !params.provider.trim() || /[\r\n\u0000]/.test(params.provider) || utf8ByteLength(params.provider.trim()) > 64)) throw new Error("runs.host('" + key + "') provider must be a non-empty single-line string of at most 64 bytes.");
   assertJsonValue(params, "runs.host('" + key + "') params");
   if (hostKeys.has(key) || runFingerprints.has(key)) throw new Error("Workflow key '" + key + "' is already in use.");
   if (hostKeys.size >= 32) throw new Error("workflowScript supports at most 32 runs.host calls.");
@@ -758,6 +831,7 @@ function launchRunsAllPermissive(items) {
 
 const runs = Object.freeze({
   run(key, params) {
+    if (key && typeof key === "object" && !Array.isArray(key)) throw new Error('runs.run expects (key, params); got an object as the first argument. Use runs.run("plan", { agent, task }) or runs.all([{ key, agent, task }]).');
     validateRunCall(key, params, "runs.run", runFingerprints);
     const launched = runHostCall(key, params, false);
     return trackRunObservation([{ key, operation: "run", callId: launched.callId }], launched.promise.then(decorateWorkflowChildResult));
@@ -806,14 +880,221 @@ const state = Object.freeze({
   },
 });
 
-let contextObjectPrototype;
+const contextObjectPrototype = scriptRealm.objectPrototype;
 
 const capturedConsole = Object.freeze(Object.fromEntries(
   ["log", "info", "warn", "error"].map((level) => [level, (...args) => {
-    parentPort.postMessage({ type: "console", level, text: args.map((value) => typeof value === "string" ? value : inspect(value, { depth: 4, breakLength: 120 })).join(" ") });
+    post({ type: "console", level, text: args.map((value) => typeof value === "string" ? value : inspectValue(value)).join(" ") });
   }]),
 ));
 
+function postWorkflowError(error) {
+  // Pre-run syntax and portability errors are tagged "validation" where the script is compiled;
+  // anything reaching here was thrown while the script ran, including a runtime SyntaxError.
+  const taggedKind = error && (typeof error === "object" || typeof error === "function") ? workflowErrorKinds.get(error) : undefined;
+  post({ type: "error", error: isSyntaxError(error) ? formatWorkflowScriptSyntaxError(error) : formatWorkflowScriptError(error), errorKind: taggedKind ?? "script" });
+}
+function assertJsonValue(value, path = "emit", seen = new Set()) {
+
+  if (value === null || typeof value === "string" || typeof value === "boolean") return;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new Error(path + " must contain only finite JSON numbers.");
+    return;
+  }
+  if (typeof value !== "object") throw new Error(path + " must be a JSON value; received " + typeof value + ".");
+  if (seen.has(value)) throw new Error(path + " must not contain cycles.");
+  seen.add(value);
+  if (Array.isArray(value)) {
+    for (let index = 0; index < value.length; index++) {
+      if (!Object.prototype.hasOwnProperty.call(value, index)) throw new Error(path + " must not contain sparse array entries.");
+      assertJsonValue(value[index], path + "[" + index + "]", seen);
+    }
+  } else {
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== null && prototype !== Object.prototype && prototype !== contextObjectPrototype) throw new Error(path + " must contain only plain JSON objects.");
+    if (Object.getOwnPropertySymbols(value).length > 0) throw new Error(path + " must not contain symbol keys.");
+    for (const [key, entry] of Object.entries(value)) assertJsonValue(entry, path + "." + key, seen);
+  }
+  seen.delete(value);
+}
+
+function isPlainWorkflowObject(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === null || prototype === Object.prototype || prototype === contextObjectPrototype;
+}
+
+function unwrapRunsAllResults(value, seen = new Map()) {
+  if (value === null || typeof value !== "object") return value;
+  const runsAllTarget = runsAllResultTargets.get(value);
+  const target = runsAllTarget || value;
+  if (seen.has(target)) return seen.get(target);
+  if (Array.isArray(target)) {
+    const copy = [];
+    seen.set(target, copy);
+    let changed = !!runsAllTarget;
+    for (let index = 0; index < target.length; index++) {
+      copy[index] = unwrapRunsAllResults(target[index], seen);
+      changed ||= copy[index] !== target[index];
+    }
+    return changed ? copy : target;
+  }
+  if (!isPlainWorkflowObject(target) || Object.getOwnPropertySymbols(target).length > 0) return target;
+  let changed = false;
+  const entries = Object.entries(target).map(([key, entry]) => {
+    const unwrapped = unwrapRunsAllResults(entry, seen);
+    changed ||= unwrapped !== entry;
+    return [key, unwrapped];
+  });
+  return changed ? Object.fromEntries(entries) : target;
+}
+
+function omitUndefinedWorkflowValues(value, seen = new Set()) {
+  if (value === null || typeof value !== "object") return value;
+  if (seen.has(value)) return value;
+  seen.add(value);
+  const normalized = Array.isArray(value)
+    ? value.map((entry) => entry === undefined ? null : omitUndefinedWorkflowValues(entry, seen))
+    : isPlainWorkflowObject(value) && Object.getOwnPropertySymbols(value).length === 0
+      ? Object.fromEntries(Object.entries(value).flatMap(([key, entry]) => entry === undefined ? [] : [[key, omitUndefinedWorkflowValues(entry, seen)]]))
+      : value;
+  seen.delete(value);
+  return normalized;
+}
+
+const scriptGlobals = { runs, Promise: workflowPromise, emit(value) { const unwrapped = unwrapRunsAllResults(value); const emittedValue = unwrapped === undefined ? null : omitUndefinedWorkflowValues(unwrapped); assertJsonValue(emittedValue); post({ type: "emit", value: emittedValue }); }, console: capturedConsole };
+if (stateEnabled) scriptGlobals.state = state;
+
+function deliver(callId, ok, encodedValue, errorText, errorKind) {
+  const entry = pending.get(callId);
+  if (!entry) return;
+  pending.delete(callId);
+  if (ok) entry.resolve(JSON.parse(encodedValue).value);
+  else {
+    const error = new Error(errorText);
+    if (errorKind === "child" || errorKind === "detached-child") workflowErrorKinds.set(error, errorKind);
+    entry.reject(error);
+  }
+}
+
+let nativeThenDescriptor;
+
+function beginWorkflowScript() {
+  try {
+    nativeThenDescriptor = Object.getOwnPropertyDescriptor(nativePromisePrototype, "then");
+    if (!nativeThenDescriptor || typeof nativeThenDescriptor.value !== "function") throw new Error("workflowScript could not inspect the VM Promise.prototype.then method.");
+    const nativeThen = nativeThenDescriptor.value;
+    // Some hosts freeze built-ins in every realm, which makes then read-only. The promise hooks
+    // still track observation, so skip the wrapper rather than fail every workflow.
+    if (nativeThenDescriptor.configurable) Object.defineProperty(nativePromisePrototype, "then", {
+      ...nativeThenDescriptor,
+      value: function workflowPromiseThen(...args) {
+        if (isDirectWorkflowScriptPromiseHandlerCall() || suppressNativePromiseConsumption > 0) {
+          return withSuppressedNativePromiseConsumption(() => Reflect.apply(nativeThen, this, args));
+        }
+        return Reflect.apply(nativeThen, this, args);
+      },
+    });
+    return true;
+  } catch (error) {
+    postWorkflowError(error);
+    return false;
+  }
+}
+
+function hookBefore(promise) {
+  if (!isWorkflowRealmPromise(promise)) return;
+  activeNativePromises.push(promise);
+}
+
+function hookAfter(promise) {
+  // Compare by identity rather than lastIndexOf: this may be a worker promise, and a script can replace Array methods.
+  for (let index = activeNativePromises.length - 1; index >= 0; index--) {
+    if (activeNativePromises[index] !== promise) continue;
+    activeNativePromises.splice(index, 1);
+    return;
+  }
+}
+
+function hookInit(promise, parent) {
+  if (!isWorkflowRealmPromise(promise)) return;
+  const childTracker = nativePromiseTracker(promise);
+  if (!parent || !isWorkflowRealmPromise(parent)) return;
+  nativePromiseParents.set(promise, parent);
+  const parentTracker = nativePromiseTracker(parent);
+  addTrackerDependency(childTracker, parentTracker);
+  const activePromise = activeNativePromises.at(-1);
+  if (activePromise && activePromise !== parent) {
+    addTrackerDependency(nativePromiseTracker(activePromise), parentTracker);
+  } else if (!activePromise && suppressNativePromiseConsumption === 0) {
+    markTrackedObservationsConsumed(parentTracker);
+  }
+}
+
+function endWorkflowScript() {
+  try {
+    let stopped = false;
+    try {
+      stopped = bridge.stopPromiseHooks();
+    } catch {}
+    if (stopped !== true) throw new Error("Workflow runtime could not stop its promise hooks.");
+  } finally {
+    try {
+      if (nativeThenDescriptor.configurable) Object.defineProperty(nativePromisePrototype, "then", nativeThenDescriptor);
+    } finally {
+      topLevelWorkflowPromise = undefined;
+      activeNativePromises.length = 0;
+      suppressNativePromiseConsumption = 0;
+      nativePromiseTrackers = new WeakMap();
+      nativePromiseParents = new WeakMap();
+    }
+  }
+}
+
+function completeWorkflowScript(value) {
+  const persistedValue = value === undefined ? null : omitUndefinedWorkflowValues(value);
+  try {
+    assertJsonValue(persistedValue, "return");
+  } catch (error) {
+    post({ type: "error", errorKind: "return-serialization", errorPhase: "return-serialization", error: formatWorkflowScriptError(error) });
+    return;
+  }
+  post({ type: "complete", value: persistedValue });
+}
+
+// The worker ran the compiled script: `result` is its completion value, or what it threw synchronously.
+function awaitWorkflowScript(threw, result) {
+  let settled;
+  try {
+    if (threw) throw result;
+    topLevelWorkflowPromise = result;
+    markTrackedObservationsConsumed(nativePromiseTracker(result));
+    settled = Promise.resolve(result);
+  } catch (error) {
+    settled = Promise.reject(error);
+  }
+  settled.then((value) => {
+    endWorkflowScript();
+    completeWorkflowScript(value);
+  }, (error) => {
+    endWorkflowScript();
+    postWorkflowError(error);
+  }).catch(postWorkflowError);
+}
+
+return Object.freeze({
+  __proto__: null,
+  scriptGlobals: Object.freeze(scriptGlobals),
+  deliver,
+  beginWorkflowScript,
+  hookBefore,
+  hookAfter,
+  hookInit,
+  awaitWorkflowScript,
+  reportError: postWorkflowError,
+});
+}
+
 function formatWorkflowScriptSyntaxError(error) {
   const details = formatWorkflowScriptError(error);
   return [
@@ -836,17 +1117,11 @@ function isSyntaxError(error) {
   return error instanceof SyntaxError || error?.name === "SyntaxError";
 }
 
-function postWorkflowError(error) {
-  // Pre-run syntax and portability errors are tagged "validation" where the script is compiled;
-  // anything reaching here was thrown while the script ran, including a runtime SyntaxError.
-  const taggedKind = error && (typeof error === "object" || typeof error === "function") ? workflowErrorKinds.get(error) : undefined;
-  parentPort.postMessage({ type: "error", error: isSyntaxError(error) ? formatWorkflowScriptSyntaxError(error) : formatWorkflowScriptError(error), errorKind: taggedKind ?? "script" });
-}
-
-process.on("unhandledRejection", postWorkflowError);
-
 const NESTED_ASYNC_WORKFLOW_ERROR = "workflowScript validation failed before child launch; no children launched. workflowScript does not support nested async functions. Use top-level await, plain helper functions that return runs.run(...), or explicit Promise chains so workflows stay portable across Node and Bun. Parallel plus sequential rewrite: const a = runs.run(\"a\", { agent: \"worker\", task: \"A\" }); const writer = await runs.run(\"writer\", { agent: \"worker\", task: \"Write\" }); const review = await runs.run(\"review\", { agent: \"reviewer\", task: writer.output }); const [aResult] = await Promise.all([a]); return { a: aResult.output, issue: { writerRunId: writer.runId, reviewRunId: review.runId } };";
 const AST_SCALAR_KEYS = new Set(["type", "start", "end"]);
+// A script context has no module loader, and Node and Bun reject import() there with an error built in
+// the worker realm, so the call is refused before the script runs.
+const DYNAMIC_IMPORT_WORKFLOW_ERROR = "workflowScript validation failed before child launch; no children launched. workflowScript cannot load modules with import().";
 
 function assertPortableWorkflowScript(source) {
   const wrapped = "(async () => {\n" + source + "\n})()";
@@ -863,7 +1138,8 @@ function assertPortableWorkflowScript(source) {
     throw error;
   }
   const wrapper = workflowWrapperFunction(ast);
-  walkWorkflowAst(wrapper.body, wrapper);
+  // Walk the whole program, not just the wrapper body: a script can close the wrapper early.
+  walkWorkflowAst(ast, wrapper);
 }
 
 function workflowWrapperFunction(ast) {
@@ -885,183 +1161,182 @@ function walkWorkflowAst(node, allowedAsyncFunction) {
   if (node !== allowedAsyncFunction && isAsyncFunctionNode(node)) {
     throw new Error(NESTED_ASYNC_WORKFLOW_ERROR);
   }
+  if (node.type === "ImportExpression") throw new Error(DYNAMIC_IMPORT_WORKFLOW_ERROR);
   for (const [key, child] of Object.entries(node)) {
     if (AST_SCALAR_KEYS.has(key)) continue;
     walkWorkflowAst(child, allowedAsyncFunction);
   }
 }
 
-function assertJsonValue(value, path = "emit", seen = new Set()) {
-  if (value === null || typeof value === "string" || typeof value === "boolean") return;
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) throw new Error(path + " must contain only finite JSON numbers.");
-    return;
-  }
-  if (typeof value !== "object") throw new Error(path + " must be a JSON value; received " + typeof value + ".");
-  if (seen.has(value)) throw new Error(path + " must not contain cycles.");
-  seen.add(value);
-  if (Array.isArray(value)) {
-    for (let index = 0; index < value.length; index++) {
-      if (!Object.prototype.hasOwnProperty.call(value, index)) throw new Error(path + " must not contain sparse array entries.");
-      assertJsonValue(value[index], path + "[" + index + "]", seen);
-    }
-  } else {
-    const prototype = Object.getPrototypeOf(value);
-    if (prototype !== null && prototype !== Object.prototype && prototype !== contextObjectPrototype) throw new Error(path + " must contain only plain JSON objects.");
-    if (Object.getOwnPropertySymbols(value).length > 0) throw new Error(path + " must not contain symbol keys.");
-    for (const [key, entry] of Object.entries(value)) assertJsonValue(entry, path + "." + key, seen);
-  }
-  seen.delete(value);
+// The error-format helpers run in both realms; the runtime realm compiles its own copies from their source.
+const WORKFLOW_RUNTIME_SOURCE = [
+  "(function (bridge, scriptRealm, stateEnabled) {",
+  "\"use strict\";",
+  formatWorkflowScriptSyntaxError,
+  formatWorkflowScriptError,
+  isSyntaxError,
+  "return (" + workflowRuntime + ")(bridge, scriptRealm, stateEnabled);",
+  "})",
+].join("\n");
+
+const VM_CONTEXT_OPTIONS = { codeGeneration: { strings: false, wasm: false } };
+const LOCK_PREPARE_STACK_TRACE_SOURCE = "Object.defineProperty(Error, \"prepareStackTrace\", { value: undefined, writable: false, enumerable: false, configurable: false });";
+
+// A null-prototype sandbox keeps globalThis.constructor out of the worker realm. The sandbox itself is
+// still a worker-realm object, and Bun forwards a failed global redefinition to it as the worker's
+// TypeError; lockWorkerRealm makes that error useless. vm.constants.DONT_CONTEXTIFY would avoid the
+// sandbox, but Bun 1.3 ignores properties defined on such a global, so the script API could not be installed.
+function createVmRealm() {
+  return vm.createContext(Object.create(null), VM_CONTEXT_OPTIONS);
+}
+
+// Runs once the worker has compiled everything it needs, right before the script starts. A worker-realm
+// value can still reach a script through engine paths (see workflowRuntime), so take away what such a
+// value would be used for: no worker function's constructor compiles code, and no script can install a
+// stack formatter that hands it worker frames.
+function lockWorkerRealm() {
+  const refuse = function Function() {
+    throw new TypeError("Code generation is disabled in the workflow worker.");
+  };
+  const functionPrototypes = [
+    Function.prototype,
+    Object.getPrototypeOf(async function () {}),
+    Object.getPrototypeOf(function* () {}),
+    Object.getPrototypeOf(async function* () {}),
+  ];
+  // A host that froze these already chose their values; redefining them would throw and fail every workflow.
+  const lock = (target, key, value) => {
+    if (Object.getOwnPropertyDescriptor(target, key)?.configurable === false) return;
+    Object.defineProperty(target, key, { value, writable: false, enumerable: false, configurable: false });
+  };
+  for (const prototype of functionPrototypes) lock(prototype, "constructor", refuse);
+  lock(Error, "prepareStackTrace", Error.prepareStackTrace);
 }
+const INSPECT_OPTIONS = { depth: 4, breakLength: 120, customInspect: false };
 
-function isPlainWorkflowObject(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const prototype = Object.getPrototypeOf(value);
-  return prototype === null || prototype === Object.prototype || prototype === contextObjectPrototype;
-}
+let runtime;
+let stopWorkflowPromiseHook;
 
-function unwrapRunsAllResults(value, seen = new Map()) {
-  if (value === null || typeof value !== "object") return value;
-  const runsAllTarget = runsAllResultTargets.get(value);
-  const target = runsAllTarget || value;
-  if (seen.has(target)) return seen.get(target);
-  if (Array.isArray(target)) {
-    const copy = [];
-    seen.set(target, copy);
-    let changed = !!runsAllTarget;
-    for (let index = 0; index < target.length; index++) {
-      copy[index] = unwrapRunsAllResults(target[index], seen);
-      changed ||= copy[index] !== target[index];
+// Each method takes and returns only strings, numbers and booleans, and catches its own failures.
+// inspect is the one exception on input: it formats a script value without calling script-defined
+// custom inspectors, which would receive worker-realm arguments.
+const bridge = Object.freeze({
+  __proto__: null,
+  post(json) {
+    try {
+      parentPort.postMessage(JSON.parse(json));
+      return true;
+    } catch {
+      return false;
     }
-    return changed ? copy : target;
-  }
-  if (!isPlainWorkflowObject(target) || Object.getOwnPropertySymbols(target).length > 0) return target;
-  let changed = false;
-  const entries = Object.entries(target).map(([key, entry]) => {
-    const unwrapped = unwrapRunsAllResults(entry, seen);
-    changed ||= unwrapped !== entry;
-    return [key, unwrapped];
-  });
-  return changed ? Object.fromEntries(entries) : target;
-}
+  },
+  inspect(value) {
+    try {
+      return JSON.stringify([true, inspect(value, INSPECT_OPTIONS)]);
+    } catch (error) {
+      const message = error && typeof error.message === "string" ? error.message : "console could not format a value.";
+      return JSON.stringify([false, message]);
+    }
+  },
+  utf8Length(value) {
+    try {
+      return typeof value === "string" ? new TextEncoder().encode(value).byteLength : -1;
+    } catch {
+      return -1;
+    }
+  },
+  utf8Prefix(value, maxBytes) {
+    try {
+      if (typeof value !== "string" || typeof maxBytes !== "number") return undefined;
+      return new TextDecoder().decode(new TextEncoder().encode(value).subarray(0, maxBytes), { stream: true });
+    } catch {
+      return undefined;
+    }
+  },
+  stopPromiseHooks() {
+    const stop = stopWorkflowPromiseHook;
+    stopWorkflowPromiseHook = undefined;
+    try {
+      stop?.();
+      return true;
+    } catch {
+      return false;
+    }
+  },
+});
 
-function omitUndefinedWorkflowValues(value, seen = new Set()) {
-  if (value === null || typeof value !== "object") return value;
-  if (seen.has(value)) return value;
-  seen.add(value);
-  const normalized = Array.isArray(value)
-    ? value.map((entry) => entry === undefined ? null : omitUndefinedWorkflowValues(entry, seen))
-    : isPlainWorkflowObject(value) && Object.getOwnPropertySymbols(value).length === 0
-      ? Object.fromEntries(Object.entries(value).flatMap(([key, entry]) => entry === undefined ? [] : [[key, omitUndefinedWorkflowValues(entry, seen)]]))
-      : value;
-  seen.delete(value);
-  return normalized;
+function postWorkerError(error) {
+  parentPort.postMessage({ type: "error", error: isSyntaxError(error) ? formatWorkflowScriptSyntaxError(error) : formatWorkflowScriptError(error), errorKind: "script" });
 }
 
+process.on("unhandledRejection", (reason) => {
+  // A worker-realm reason is the worker's own failure; it must not enter the runtime realm.
+  if (runtime && !(reason instanceof Object)) runtime.reportError(reason);
+  else postWorkerError(reason);
+});
+
 function deepFreezeWorkflowArgs(value) {
   if (value === null || typeof value !== "object" || Object.isFrozen(value)) return value;
   for (const entry of Object.values(value)) deepFreezeWorkflowArgs(entry);
   return Object.freeze(value);
 }
 
-parentPort.on("message", async (message) => {
-  if (message.type === "response") {
-    const entry = pending.get(message.callId);
-    if (!entry) return;
-    pending.delete(message.callId);
-    if (message.ok) entry.resolve(message.value);
-    else {
-      const error = new Error(message.error);
-      if (message.errorKind === "child" || message.errorKind === "detached-child") workflowErrorKinds.set(error, message.errorKind);
-      entry.reject(error);
-    }
+function startWorkflow(message) {
+  const context = createVmRealm();
+  const runtimeContext = createVmRealm();
+  // Bun hands Error.prepareStackTrace call sites (and the array holding them) from the worker's realm,
+  // whatever context the error came from. Lock it in both realms before any code runs there.
+  for (const realm of [context, runtimeContext]) vm.runInContext(LOCK_PREPARE_STACK_TRACE_SOURCE, realm);
+  const scriptRealm = vm.runInContext("({ __proto__: null, objectPrototype: Object.prototype, promisePrototype: (async () => {})().constructor.prototype })", context);
+  const createRuntime = new vm.Script(WORKFLOW_RUNTIME_SOURCE, { filename: "pi-workflow-runtime.js" }).runInContext(runtimeContext);
+  runtime = createRuntime(bridge, scriptRealm, Boolean(message.stateEnabled));
+  Object.assign(context, runtime.scriptGlobals);
+  // Rebuild args inside the VM realm: a worker-realm object would expose the worker's unrestricted
+  // Function through args.constructor.constructor, bypassing codeGeneration.strings: false.
+  context.args = deepFreezeWorkflowArgs(vm.runInContext("JSON.parse", context)(JSON.stringify(message.args ?? {})));
+  let compiled;
+  try {
+    assertPortableWorkflowScript(message.script);
+    compiled = new vm.Script("(async () => {\n" + message.script + "\n})()", { filename: "workflow-script.js", lineOffset: -1 });
+  } catch (error) {
+    parentPort.postMessage({ type: "error", errorKind: "validation", error: isSyntaxError(error) ? formatWorkflowScriptSyntaxError(error) : formatWorkflowScriptError(error) });
     return;
   }
-  if (message.type !== "start") return;
+  if (!runtime.beginWorkflowScript()) return;
+  stopWorkflowPromiseHook = createWorkflowPromiseHook({ init: runtime.hookInit, before: runtime.hookBefore, after: runtime.hookAfter });
+  lockWorkerRealm();
+  let result;
+  let threw = false;
   try {
-    const sandbox = { runs, Promise: workflowPromise, emit(value) { const unwrapped = unwrapRunsAllResults(value); const emittedValue = unwrapped === undefined ? null : omitUndefinedWorkflowValues(unwrapped); assertJsonValue(emittedValue); parentPort.postMessage({ type: "emit", value: emittedValue }); }, console: capturedConsole };
-    if (message.stateEnabled) sandbox.state = state;
-    const context = vm.createContext(sandbox, { codeGeneration: { strings: false, wasm: false } });
-    contextObjectPrototype = vm.runInContext("Object.prototype", context);
-    // Rebuild args inside the VM realm: a worker-realm object would expose the worker's unrestricted
-    // Function through args.constructor.constructor, bypassing codeGeneration.strings: false.
-    sandbox.args = deepFreezeWorkflowArgs(vm.runInContext("JSON.parse", context)(JSON.stringify(message.args ?? {})));
-    let compiled;
-    try {
-      assertPortableWorkflowScript(message.script);
-      compiled = new vm.Script("(async () => {\n" + message.script + "\n})()", { filename: "workflow-script.js", lineOffset: -1 });
-    } catch (error) {
-      parentPort.postMessage({ type: "error", errorKind: "validation", error: isSyntaxError(error) ? formatWorkflowScriptSyntaxError(error) : formatWorkflowScriptError(error) });
+    result = compiled.runInContext(context);
+  } catch (error) {
+    threw = true;
+    result = error;
+  }
+  runtime.awaitWorkflowScript(threw, result);
+}
+
+parentPort.on("message", (message) => {
+  if (message.type === "response") {
+    if (!runtime || typeof message.callId !== "number") return;
+    if (!message.ok) {
+      runtime.deliver(message.callId, false, undefined, message.error === undefined ? undefined : String(message.error), typeof message.errorKind === "string" ? message.errorKind : undefined);
       return;
     }
-    const nativePromisePrototype = vm.runInContext("(async () => {})().constructor.prototype", context);
-    const nativeThenDescriptor = Object.getOwnPropertyDescriptor(nativePromisePrototype, "then");
-    if (!nativeThenDescriptor || typeof nativeThenDescriptor.value !== "function") throw new Error("workflowScript could not inspect the VM Promise.prototype.then method.");
-    const nativeThen = nativeThenDescriptor.value;
-    let stopWorkflowPromiseHook;
-    let value;
-    try {
-      // Some hosts freeze built-ins in every realm, which makes then read-only. The promise hooks
-      // below still track observation, so skip the wrapper rather than fail every workflow.
-      if (nativeThenDescriptor.configurable) Object.defineProperty(nativePromisePrototype, "then", {
-        ...nativeThenDescriptor,
-        value: function workflowPromiseThen(...args) {
-          if (isDirectWorkflowScriptPromiseHandlerCall() || suppressNativePromiseConsumption > 0) {
-            return withSuppressedNativePromiseConsumption(() => Reflect.apply(nativeThen, this, args));
-          }
-          return Reflect.apply(nativeThen, this, args);
-        },
-      });
-      stopWorkflowPromiseHook = createWorkflowPromiseHook({
-        before(promise) {
-          activeNativePromises.push(promise);
-        },
-        after(promise) {
-          const index = activeNativePromises.lastIndexOf(promise);
-          if (index !== -1) activeNativePromises.splice(index, 1);
-        },
-        init(promise, parent) {
-          const childTracker = nativePromiseTracker(promise);
-          if (!parent) return;
-          nativePromiseParents.set(promise, parent);
-          const parentTracker = nativePromiseTracker(parent);
-          addTrackerDependency(childTracker, parentTracker);
-          const activePromise = activeNativePromises.at(-1);
-          if (activePromise && activePromise !== parent) {
-            addTrackerDependency(nativePromiseTracker(activePromise), parentTracker);
-          } else if (!activePromise && suppressNativePromiseConsumption === 0) {
-            markTrackedObservationsConsumed(parentTracker);
-          }
-        },
-      });
-      const workflowResultPromise = compiled.runInContext(context);
-      topLevelWorkflowPromise = workflowResultPromise;
-      markTrackedObservationsConsumed(nativePromiseTracker(workflowResultPromise));
-      value = await workflowResultPromise;
-    } finally {
-      try {
-        stopWorkflowPromiseHook?.();
-      } finally {
-        try {
-          if (nativeThenDescriptor.configurable) Object.defineProperty(nativePromisePrototype, "then", nativeThenDescriptor);
-        } finally {
-          topLevelWorkflowPromise = undefined;
-          activeNativePromises.length = 0;
-          suppressNativePromiseConsumption = 0;
-          nativePromiseTrackers = new WeakMap();
-          nativePromiseParents = new WeakMap();
-        }
-      }
-    }
-    const persistedValue = value === undefined ? null : omitUndefinedWorkflowValues(value);
+    let encodedValue;
     try {
-      assertJsonValue(persistedValue, "return");
+      encodedValue = JSON.stringify({ value: message.value });
     } catch (error) {
-      parentPort.postMessage({ type: "error", errorKind: "return-serialization", errorPhase: "return-serialization", error: formatWorkflowScriptError(error) });
+      runtime.deliver(message.callId, false, undefined, "Workflow host response is not JSON: " + error.message, undefined);
       return;
     }
-    parentPort.postMessage({ type: "complete", value: persistedValue });
+    runtime.deliver(message.callId, true, encodedValue, undefined, undefined);
+    return;
+  }
+  if (message.type !== "start") return;
+  try {
+    startWorkflow(message);
   } catch (error) {
-    postWorkflowError(error);
+    postWorkerError(error);
   }
 });