pi-subagents 0.83.1 → 0.84.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "type": "module",
   "name": "pi-subagents",
-  "version": "0.83.1",
+  "version": "0.84.0",
   "description": "Pi extension for single-agent delegation and scripted multi-agent workflows",
   "author": "Nico Bailon",
   "license": "MIT",

package/src/runs/background/async-execution.d.ts

@@ -2,6 +2,7 @@
  * Async execution logic for subagent tool
  */
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import type { ParentProviderRegistry } from "../shared/child-session.ts";
 import { type AgentConfig, type UnknownAgentDiagnosticContext } from "../../agents/agents.ts";
 import { type ClaudeCodeOverride } from "../shared/claude-code-adapter.ts";
 import { type ChainStep } from "../../shared/settings.ts";
@@ -44,6 +45,8 @@ interface AsyncExecutionContext {
     childRuntime?: ChildRuntimeConfig;
     /** The launching session's project trust; undefined when the host has no trust concept. */
     projectTrusted?: boolean;
+    /** The parent's model registry, read at launch to name a provider an extension registered there. */
+    parentProviderRegistry?: Pick<ParentProviderRegistry, "getRegisteredProviderIds">;
 }
 export declare const DEFAULT_ASYNC_TIMEOUT_MS: number;
 interface AsyncChainParams {

package/src/runs/background/async-execution.js

@@ -135,6 +135,17 @@ function supportsNativeRunner(nodeExecutable) {
         && nodeExecutable === process.execPath
         && !sourceUnderNodeModules();
 }
+/**
+ * A runner child without the ambient extensions does not load the parent extension that
+ * registered its model's provider, and still resolves the model when a built-in provider
+ * has the same id. Name that provider so a failed run can say so.
+ */
+function parentExtensionProviderForChild(ctx, disableAmbientExtensions, model, availableModels, preferredProvider) {
+    if (!disableAmbientExtensions || !ctx.parentProviderRegistry)
+        return undefined;
+    const provider = findModelInfo(model, availableModels, preferredProvider)?.provider;
+    return provider && ctx.parentProviderRegistry.getRegisteredProviderIds().includes(provider) ? provider : undefined;
+}
 export const DEFAULT_ASYNC_TIMEOUT_MS = 30 * 60 * 1000;
 export function formatAsyncStartedMessage(headline, interactive) {
     const guidance = interactive
@@ -997,6 +1008,7 @@ export function buildAsyncRunnerSteps(id, params) {
             runtimeSnapshotHost: ctx.pi,
         });
         const launchResolvedExtensions = externalRunner ? undefined : projectLaunchResolvedChildExtensions(toolPlan);
+        const parentExtensionProvider = externalRunner || machine ? undefined : parentExtensionProviderForChild(ctx, toolPlan.disableAmbientExtensions, selectedModel, availableModels, a.modelProvider ?? ctx.currentModelProvider);
         if (externalRunner && permissionRules) {
             throw new AsyncStartValidationError(`Agent '${a.name}' uses runner.type='${externalRunnerType}', which cannot enforce native Pi child permission rules.`);
         }
@@ -1026,6 +1038,7 @@ export function buildAsyncRunnerSteps(id, params) {
             thinking: resolveEffectiveThinking(selectedModel, effectiveThinking),
             ...(thinkingCeiling ? { thinkingCeiling } : {}),
             launchResolvedExtensions,
+            ...(parentExtensionProvider ? { parentExtensionProvider } : {}),
             ...(requestedModel ? { requestedModel } : {}),
             ...(primaryModelFromParent ? { skipPrimaryModelVerification: true } : {}),
             ...(availableModels && availableModels.length > 0 ? { modelVerificationRegistry: availableModels } : {}),
@@ -1811,6 +1824,7 @@ export function executeAsyncSingle(id, params) {
         runtimeSnapshotHost: ctx.pi,
     });
     const launchResolvedExtensions = externalRunner ? undefined : projectLaunchResolvedChildExtensions(toolPlan);
+    const parentExtensionProvider = externalRunner || machine ? undefined : parentExtensionProviderForChild(ctx, toolPlan.disableAmbientExtensions, selectedModel, availableModels, agentConfig.modelProvider ?? ctx.currentModelProvider);
     const fast = params.fast ?? agentConfig.fast;
     const launchThinking = resolveEffectiveThinking(selectedModel, effectiveThinking);
     const { definitionDigest, launchContractDigest } = resolveLaunchBinding({
@@ -1933,6 +1947,7 @@ export function executeAsyncSingle(id, params) {
                     ...(params.fast ?? agentConfig.fast ? { fast: params.fast ?? agentConfig.fast } : {}),
                     thinking: resolveEffectiveThinking(selectedModel, effectiveThinking),
                     ...(thinkingCeiling ? { thinkingCeiling } : {}),
+                    ...(parentExtensionProvider ? { parentExtensionProvider } : {}),
                     ...(requestedModel ? { requestedModel } : {}),
                     ...(modelOrigin === "inherited" ? { skipPrimaryModelVerification: true } : {}),
                     ...(availableModels && availableModels.length > 0 ? { modelVerificationRegistry: availableModels } : {}),

package/src/runs/background/async-retention.d.ts

@@ -3,6 +3,7 @@ export declare const ASYNC_RETENTION_DAYS = 30;
 export declare const ASYNC_RETENTION_BATCH_SIZE = 100;
 export declare const ASYNC_RETENTION_DELAY_MS = 60000;
 export declare const ASYNC_RETENTION_TOMBSTONE_GRACE_MS: number;
+export declare const RESUMABLE_RETENTION_DAYS = 90;
 export interface AsyncRetentionOptions {
     asyncDirRoot: string;
     resultsDir: string;

package/src/runs/background/async-retention.js

@@ -15,7 +15,11 @@ export const ASYNC_RETENTION_DAYS = 30;
 export const ASYNC_RETENTION_BATCH_SIZE = 100;
 export const ASYNC_RETENTION_DELAY_MS = 60_000;
 export const ASYNC_RETENTION_TOMBSTONE_GRACE_MS = 24 * 60 * 60 * 1000;
+// A run or result whose session file still exists can be resumed, so it is kept this long
+// instead of ASYNC_RETENTION_DAYS. Session files outlive run dirs, so without a ceiling it is kept forever.
+export const RESUMABLE_RETENTION_DAYS = 90;
 const RETENTION_MS = ASYNC_RETENTION_DAYS * 24 * 60 * 60 * 1000;
+const RESUMABLE_RETENTION_MS = RESUMABLE_RETENTION_DAYS * 24 * 60 * 60 * 1000;
 const LOCK_NAME = ".async-retention.lock";
 const CURSOR_NAME = ".async-retention-cursor.json";
 const LOG_NAME = "async-retention-maintenance.jsonl";
@@ -239,9 +243,10 @@ function runSkipReason(input) {
         return "mission-reference";
     if (hasUnresolvedRunHandoff(runDir, status))
         return "handoff-reference";
-    if (hasResumableContract(runDir, status))
-        return "resumable";
     const timestamp = statusTimestamp(status, runDir);
+    // Unknown ages stay protected.
+    if (hasResumableContract(runDir, status) && (timestamp === undefined || timestamp > input.resumableCutoff))
+        return "resumable";
     if (timestamp === undefined)
         return "unknown-age";
     if (timestamp > input.cutoff)
@@ -464,13 +469,13 @@ function resultSkipReason(input) {
         return "workflow-reference";
     if (hasUnresolvedResultHandoff(input.data))
         return "handoff-reference";
-    if (resultHasResumableSession(input.data))
+    const timestamp = resultTimestamp(input.data, input.candidate.path);
+    if (resultHasResumableSession(input.data) && (timestamp === undefined || timestamp > input.resumableCutoff))
         return "resumable";
     if (input.candidate.kind === "archive" && fs.existsSync(path.join(input.resultsDir, "completion-replay", `${encodeURIComponent(runId)}.json`)))
         return "replay-reference";
     if (!terminalResult(input.data) && input.candidate.kind !== "replay" && input.candidate.kind !== "archive" && input.candidate.kind !== "tombstone")
         return "non-terminal-result";
-    const timestamp = resultTimestamp(input.data, input.candidate.path);
     if (timestamp === undefined)
         return "unknown-age";
     if (timestamp > input.cutoff)
@@ -690,6 +695,7 @@ export async function cleanupAsyncRetention(options) {
             return finish();
         const protectedRunIds = new Set(options.protectedRunIds ?? []);
         const cutoff = currentTime - retentionMs;
+        const resumableCutoff = currentTime - RESUMABLE_RETENTION_MS;
         const cursor = readCursor(maintenanceRoot);
         const runBudget = Math.ceil(batchSize / 2);
         const resultBudget = batchSize - runBudget;
@@ -765,7 +771,7 @@ export async function cleanupAsyncRetention(options) {
                     if (reconciliation.repaired)
                         result.repairedRuns += 1;
                 }
-                const initialReason = runSkipReason({ runDir, status, asyncDirRoot: options.asyncDirRoot, resultsDir: options.resultsDir, cutoff, protectedRunIds, waitRunIds: waitReferences.runIds });
+                const initialReason = runSkipReason({ runDir, status, asyncDirRoot: options.asyncDirRoot, resultsDir: options.resultsDir, cutoff, resumableCutoff, protectedRunIds, waitRunIds: waitReferences.runIds });
                 if (initialReason) {
                     increment(result.skipped, initialReason);
                     continue;
@@ -780,7 +786,7 @@ export async function cleanupAsyncRetention(options) {
                         continue;
                     }
                     const freshWaitReferences = parseWaitRunIds(waitSubscriptionsDir);
-                    const finalReason = freshWaitReferences.safe ? runSkipReason({ runDir, status, asyncDirRoot: options.asyncDirRoot, resultsDir: options.resultsDir, cutoff, protectedRunIds, waitRunIds: freshWaitReferences.runIds }) : "wait-references-unknown";
+                    const finalReason = freshWaitReferences.safe ? runSkipReason({ runDir, status, asyncDirRoot: options.asyncDirRoot, resultsDir: options.resultsDir, cutoff, resumableCutoff, protectedRunIds, waitRunIds: freshWaitReferences.runIds }) : "wait-references-unknown";
                     if (finalReason) {
                         increment(result.skipped, `recheck-${finalReason}`);
                         continue;
@@ -805,7 +811,7 @@ export async function cleanupAsyncRetention(options) {
                 }
                 const recheckStatus = readStatus(tombstone);
                 const freshWaitReferences = parseWaitRunIds(waitSubscriptionsDir);
-                const recheckReason = freshWaitReferences.safe ? runSkipReason({ runDir: tombstone, status: recheckStatus, asyncDirRoot: options.asyncDirRoot, resultsDir: options.resultsDir, cutoff, protectedRunIds, waitRunIds: freshWaitReferences.runIds }) : "wait-references-unknown";
+                const recheckReason = freshWaitReferences.safe ? runSkipReason({ runDir: tombstone, status: recheckStatus, asyncDirRoot: options.asyncDirRoot, resultsDir: options.resultsDir, cutoff, resumableCutoff, protectedRunIds, waitRunIds: freshWaitReferences.runIds }) : "wait-references-unknown";
                 if (recheckReason) {
                     if (!fs.existsSync(runDir)) {
                         fs.renameSync(tombstone, runDir);
@@ -842,7 +848,7 @@ export async function cleanupAsyncRetention(options) {
                     continue;
                 }
                 const data = readJson(candidate.path);
-                const reason = resultSkipReason({ candidate, data, asyncDirRoot: options.asyncDirRoot, resultsDir: options.resultsDir, maintenanceRoot, cutoff, protectedRunIds, waitRunIds: waitReferences.runIds });
+                const reason = resultSkipReason({ candidate, data, asyncDirRoot: options.asyncDirRoot, resultsDir: options.resultsDir, maintenanceRoot, cutoff, resumableCutoff, protectedRunIds, waitRunIds: waitReferences.runIds });
                 if (reason) {
                     increment(result.skipped, reason);
                     continue;
@@ -853,7 +859,7 @@ export async function cleanupAsyncRetention(options) {
                         continue;
                     }
                     const freshWaitReferences = parseWaitRunIds(waitSubscriptionsDir);
-                    const finalReason = freshWaitReferences.safe ? resultSkipReason({ candidate, data, asyncDirRoot: options.asyncDirRoot, resultsDir: options.resultsDir, maintenanceRoot, cutoff, protectedRunIds, waitRunIds: freshWaitReferences.runIds }) : "wait-references-unknown";
+                    const finalReason = freshWaitReferences.safe ? resultSkipReason({ candidate, data, asyncDirRoot: options.asyncDirRoot, resultsDir: options.resultsDir, maintenanceRoot, cutoff, resumableCutoff, protectedRunIds, waitRunIds: freshWaitReferences.runIds }) : "wait-references-unknown";
                     if (finalReason) {
                         increment(result.skipped, `recheck-${finalReason}`);
                         continue;
@@ -870,7 +876,7 @@ export async function cleanupAsyncRetention(options) {
                 const tombstoneCandidate = { ...candidate, path: tombstone, kind: "tombstone" };
                 const recheckData = readJson(tombstone);
                 const freshWaitReferences = parseWaitRunIds(waitSubscriptionsDir);
-                const recheckReason = freshWaitReferences.safe ? resultSkipReason({ candidate: tombstoneCandidate, data: recheckData, asyncDirRoot: options.asyncDirRoot, resultsDir: options.resultsDir, maintenanceRoot, cutoff, protectedRunIds, waitRunIds: freshWaitReferences.runIds }) : "wait-references-unknown";
+                const recheckReason = freshWaitReferences.safe ? resultSkipReason({ candidate: tombstoneCandidate, data: recheckData, asyncDirRoot: options.asyncDirRoot, resultsDir: options.resultsDir, maintenanceRoot, cutoff, resumableCutoff, protectedRunIds, waitRunIds: freshWaitReferences.runIds }) : "wait-references-unknown";
                 if (recheckReason) {
                     if (!fs.existsSync(candidate.path)) {
                         fs.renameSync(tombstone, candidate.path);

package/src/runs/background/run-child-session.d.ts

@@ -83,6 +83,8 @@ export interface RunChildSessionInput {
     }>;
     modelResponseAliases?: Record<string, string[]>;
     mutationTools?: readonly string[];
+    /** Provider of the launch model that a parent extension registered and this child does not load. */
+    parentExtensionProvider?: string;
 }
 export interface RunChildSessionResult {
     exitCode: number;

package/src/runs/background/run-child-session.js

@@ -3,7 +3,7 @@ import { qualifyModelWithProvider } from "../../shared/model-info.js";
 import { acceptChildWatchdogEvent, applyChildWatchdogMessage, childWatchdogIsActive, isChildWatchdogStatusEvent, } from "../../watchdog/child-status.js";
 import { projectChildLifecycle } from "../shared/child-lifecycle.js";
 import { formatSubagentModelVerificationError } from "../shared/model-resolution.js";
-import { formatChildModelResolutionDiagnostic, isChildModelResolutionFailure } from "../shared/model-resolution-diagnostic.js";
+import { formatChildModelResolutionDiagnostic, formatMissingParentProviderDiagnostic, isChildModelResolutionFailure } from "../shared/model-resolution-diagnostic.js";
 import { isMutatingTool, resolveCurrentPath } from "../shared/long-running-guard.js";
 import { effectiveToolTimeoutMs, formatToolTimeoutMessage, toolTimeoutCallKey } from "../shared/tool-timeout.js";
 import { createReportedChildSessionInput } from "../shared/child-launch.js";
@@ -520,6 +520,14 @@ export function runChildSession(input) {
                 && !input.launch.session.ambientExtensions) {
                 finalError = `${promptErrorMessage}\n\n${formatChildModelResolutionDiagnostic({ agent: input.launch.config.agent, model: input.launch.session.model, host: "runner", capabilityCeiling: input.launch.toolPlan.capabilityCeiling })}`;
             }
+            else if (input.parentExtensionProvider
+                && session?.claimedProvider !== input.parentExtensionProvider
+                && finalError !== undefined
+                && (finalError === promptErrorMessage || finalError === assistantError)
+                && toolCount === 0
+                && messages.every((message) => message.role !== "assistant" || message.stopReason === "error")) {
+                finalError = `${finalError}\n\n${formatMissingParentProviderDiagnostic({ agent: input.launch.config.agent, model: input.launch.session.model, provider: input.parentExtensionProvider, capabilityCeiling: input.launch.toolPlan.capabilityCeiling })}`;
+            }
             const forcedDrainAfterFinalSuccess = (forced || forcedTermination) && (cleanTerminalAssistantStopReceived || agentSettledReceived) && !finalError;
             const forcedDrainAfterEmptyTerminal = forcedDrainAfterFinalSuccess && hasEmptyTerminalAssistantResponse(messages);
             if (!finalError && forced && !forcedDrainAfterFinalSuccess && !interrupted && !timedOut && !stopped) {

package/src/runs/background/subagent-runner.js

@@ -938,6 +938,7 @@ export async function runSingleStepInner(step, ctx) {
             modelVerificationRegistry: step.modelVerificationRegistry,
             modelResponseAliases: step.modelResponseAliases,
             mutationTools: step.mutationTools,
+            parentExtensionProvider: step.parentExtensionProvider,
         }));
         launched = true;
         aggregateUsage.input += run.usage.input;

package/src/runs/foreground/subagent-executor.js

@@ -1018,6 +1018,7 @@ function appendStepToAsyncChain(input) {
         parentSessionId: input.ctx.sessionManager.getSessionId() ?? undefined,
         parentSessionFile: input.ctx.sessionManager.getSessionFile() ?? undefined,
         currentModelProvider: parentModel?.provider,
+        parentProviderRegistry: input.ctx.modelRegistry,
         currentModel: parentModel,
         scopedModelIds: scopedModelIdsFromContext(input.ctx),
         modelScope: discoveredForAppend.modelScope,
@@ -1505,6 +1506,7 @@ async function resumeExternalJobFollowUp(input) {
             parentSessionId: input.ctx.sessionManager.getSessionId() ?? undefined,
             parentSessionFile: input.ctx.sessionManager.getSessionFile() ?? undefined,
             currentModelProvider: parentModel?.provider,
+            parentProviderRegistry: input.ctx.modelRegistry,
             currentModel: parentModel,
             scopedModelIds: scopedModelIdsFromContext(input.ctx),
             modelScope: input.modelScope,
@@ -1793,6 +1795,7 @@ async function resumeAsyncRun(input) {
                 parentSessionId: input.ctx.sessionManager.getSessionId() ?? undefined,
                 parentSessionFile: input.ctx.sessionManager.getSessionFile() ?? undefined,
                 currentModelProvider: parentModel?.provider,
+                parentProviderRegistry: input.ctx.modelRegistry,
                 currentModel: parentModel,
                 scopedModelIds: scopedModelIdsFromContext(input.ctx),
                 modelScope,
@@ -1934,6 +1937,7 @@ async function resumeAsyncRun(input) {
             parentSessionId: input.ctx.sessionManager.getSessionId() ?? undefined,
             parentSessionFile: input.ctx.sessionManager.getSessionFile() ?? undefined,
             currentModelProvider: parentModel?.provider,
+            parentProviderRegistry: input.ctx.modelRegistry,
             currentModel: parentModel,
             scopedModelIds: scopedModelIdsFromContext(input.ctx),
             modelScope,
@@ -3105,6 +3109,7 @@ async function runAsyncPath(data, deps) {
         parentSessionId: data.parentPiSessionId,
         parentSessionFile: ctx.sessionManager.getSessionFile() ?? undefined,
         currentModelProvider: parentModel?.provider,
+        parentProviderRegistry: ctx.modelRegistry,
         currentModel: parentModel,
         scopedModelIds: data.scopedModelIds,
         modelScope: data.modelScope,

package/src/runs/shared/child-session.d.ts

@@ -109,6 +109,8 @@ export interface ChildSession {
     readonly modelId: string | undefined;
     /** Provider id of the selected model when this child inherited that provider from the parent's registry instead of loading its extension. */
     readonly inheritedProvider?: string;
+    /** Provider id of the selected model when an extension in this child's model runtime registered that provider, at load or later (e.g. on `session_start`). */
+    readonly claimedProvider?: string;
     /** Live provider/id of the selected model when Pi marks it virtual (`api === "pi-virtual"`); assistant messages then name the dispatched physical model. */
     readonly virtualModelId?: string;
     readonly contextWindow?: number;

package/src/runs/shared/child-session.js

@@ -633,6 +633,7 @@ export function createDefaultChildSessionFactory(options = {}) {
                 get sessionId() { return session.sessionId; },
                 get modelId() { return session.model ? `${session.model.provider}/${session.model.id}` : undefined; },
                 get inheritedProvider() { return session.model && inheritedProviders.has(session.model.provider) ? session.model.provider : undefined; },
+                get claimedProvider() { return session.model && !inheritedProviders.has(session.model.provider) && modelRuntime.getRegisteredProviderIds().includes(session.model.provider) ? session.model.provider : undefined; },
                 get virtualModelId() { return session.model?.api === "pi-virtual" ? `${session.model.provider}/${session.model.id}` : undefined; },
                 get contextWindow() { return session.model?.contextWindow; },
             };

package/src/runs/shared/model-resolution-diagnostic.d.ts

@@ -31,3 +31,14 @@ export declare function formatChildModelResolutionDiagnostic(diagnostic: ChildMo
 export declare function formatInheritedProviderDiagnostic(diagnostic: ChildModelResolutionDiagnostic & {
     provider: string;
 }): string;
+/**
+ * Explain a background child that failed before any successful response on a
+ * provider a parent extension registered, when that extension did not load in
+ * the child. A parent extension can register a provider under a built-in id,
+ * so the model still resolves in the child, through the built-in provider
+ * rather than the parent's. Whether that caused this failure is unknown here,
+ * hence the conditional wording.
+ */
+export declare function formatMissingParentProviderDiagnostic(diagnostic: ChildModelResolutionDiagnostic & {
+    provider: string;
+}): string;

package/src/runs/shared/model-resolution-diagnostic.js

@@ -89,3 +89,28 @@ export function formatInheritedProviderDiagnostic(diagnostic) {
         `If ${provider} depends on those hooks, run this agent with \`async: true\` (a background child loads the ambient extensions unless the agent sets \`extensions\`), or load the extension for this agent with \`subagentOnlyExtensions\` or \`extensions\` in the agent frontmatter.`,
     ].join("\n");
 }
+/**
+ * Explain a background child that failed before any successful response on a
+ * provider a parent extension registered, when that extension did not load in
+ * the child. A parent extension can register a provider under a built-in id,
+ * so the model still resolves in the child, through the built-in provider
+ * rather than the parent's. Whether that caused this failure is unknown here,
+ * hence the conditional wording.
+ */
+export function formatMissingParentProviderDiagnostic(diagnostic) {
+    const subject = diagnostic.agent ? `Agent '${diagnostic.agent}'` : "Subagent";
+    const model = diagnostic.model ? `'${diagnostic.model}'` : "this model";
+    const provider = `'${diagnostic.provider}'`;
+    const facts = `${subject} ran as a background child without the ambient extensions. In the parent, provider ${provider} for ${model} is registered by an extension that did not load in this child, so the child sent its requests without that extension's provider, through the built-in provider of the same id if there is one.`;
+    if (capabilityCeilingDeniesExtensions(diagnostic)) {
+        return [
+            facts,
+            `${denyExtensionsClause(diagnostic)}, so that extension cannot load for this child: listed \`subagentOnlyExtensions\` or \`extensions\` entries are suppressed, and leaving \`extensions\` unset does not enable ambient loading.`,
+            `If ${provider} depends on that extension, relax the capability ceiling to allow extensions, or use a model whose provider does not.`,
+        ].join("\n");
+    }
+    return [
+        facts,
+        `If ${provider} depends on that extension, list it in \`subagentOnlyExtensions\` or \`extensions\` in the agent frontmatter, leave \`extensions\` unset so the child loads the ambient extensions, or register it from the host with \`registerRequiredChildExtensions\` so it loads for every launch.`,
+    ].join("\n");
+}

package/src/runs/shared/parallel-utils.d.ts

@@ -55,6 +55,8 @@ export interface RunnerSubagentStep {
     }>;
     modelResponseAliases?: Record<string, string[]>;
     tools?: string[];
+    /** Provider of `model` that a parent extension registers; set only when this child loads no ambient extensions. */
+    parentExtensionProvider?: string;
     excludeTools?: string[];
     allowNestedSubagents?: boolean;
     /** Resolved selected-agent policy for launches made by this child. */

package/src/workflows/scripted-workflow.js

@@ -780,6 +780,8 @@ export function validateWorkflowScript(script, options = {}) {
         if (node !== wrapper && node.async === true && (node.type === "FunctionDeclaration" || node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression")) {
             errors.push({ message: "workflowScript does not support nested async functions. Use top-level await, plain helper functions that return runs.run(...), or explicit Promise chains.", ...nodeLocation(node) });
         }
+        if (node.type === "ImportExpression")
+            errors.push({ message: "workflowScript cannot load modules with import().", ...nodeLocation(node) });
         if (directRunsCall(node, "run")) {
             const args = Array.isArray(node.arguments) ? node.arguments : [];
             const keyNode = astNode(args[0]) ? args[0] : undefined;