runline 0.10.0 → 0.11.0

package/dist/core/engine.d.ts

@@ -9,6 +9,28 @@ export interface EngineOptions {
     timeoutMs?: number;
     memoryLimitBytes?: number;
 }
+/**
+ * Whether to arm the host-side RSS watchdog for a worker run.
+ *
+ * node enforces resourceLimits.maxOldGenerationSizeMb natively, and the
+ * watchdog measures *whole-process* RSS — arming it there would risk false
+ * kills from unrelated host allocations (e.g. a concurrent execute). bun
+ * ignores resourceLimits, so the watchdog is the only memory backstop.
+ */
+export declare function shouldArmRssWatchdog(versions?: Partial<Record<string, string>>): boolean;
+/**
+ * Executes agent code in a node:worker_threads worker.
+ *
+ * The worker is an ergonomic coding surface, not a security sandbox: agent
+ * code gets the full host JS runtime (Buffer, crypto, etc.) plus injected
+ * action proxies. Isolation properties we do enforce, fail-soft:
+ *
+ * - timeout: worker.terminate() — interrupts even `while(true){}`
+ * - memory: resourceLimits.maxOldGenerationSizeMb (node) + an RSS-delta
+ *   watchdog fallback; both surface as a clean "Memory limit exceeded" error
+ * - crash containment: a dead worker never takes the host process down, and
+ *   each execute() gets a fresh worker, so the engine stays usable
+ */
 export declare class ExecutionEngine {
     private registry;
     private config;
@@ -16,6 +38,4 @@ export declare class ExecutionEngine {
     execute(code: string, options?: EngineOptions): Promise<ExecuteResult>;
     private invokeAction;
     private resolveConnection;
-    private drainAsync;
-    private drainJobs;
 }

package/dist/core/engine.js

@@ -1,7 +1,34 @@
 import { readFileSync } from "node:fs";
-import { getQuickJS, shouldInterruptAfterDeadline, } from "quickjs-emscripten";
+import { Worker } from "node:worker_threads";
 import { applyEnvOverrides, updateConnectionConfig } from "../config/loader.js";
 import { formatValidationError, helpInputs, isTypedInputSchema, validateTypedInput, } from "../plugin/schema.js";
+/**
+ * Whether to arm the host-side RSS watchdog for a worker run.
+ *
+ * node enforces resourceLimits.maxOldGenerationSizeMb natively, and the
+ * watchdog measures *whole-process* RSS — arming it there would risk false
+ * kills from unrelated host allocations (e.g. a concurrent execute). bun
+ * ignores resourceLimits, so the watchdog is the only memory backstop.
+ */
+export function shouldArmRssWatchdog(versions = process.versions) {
+    return Boolean(versions.bun);
+}
+// Extra slack on top of the configured memory limit for the RSS watchdog,
+// since whole-process RSS includes the host's own working set.
+const RSS_WATCHDOG_SLACK_BYTES = 128 * 1024 * 1024;
+/**
+ * Executes agent code in a node:worker_threads worker.
+ *
+ * The worker is an ergonomic coding surface, not a security sandbox: agent
+ * code gets the full host JS runtime (Buffer, crypto, etc.) plus injected
+ * action proxies. Isolation properties we do enforce, fail-soft:
+ *
+ * - timeout: worker.terminate() — interrupts even `while(true){}`
+ * - memory: resourceLimits.maxOldGenerationSizeMb (node) + an RSS-delta
+ *   watchdog fallback; both surface as a clean "Memory limit exceeded" error
+ * - crash containment: a dead worker never takes the host process down, and
+ *   each execute() gets a fresh worker, so the engine stays usable
+ */
 export class ExecutionEngine {
     registry;
     config;
@@ -12,119 +39,121 @@ export class ExecutionEngine {
     async execute(code, options) {
         const timeoutMs = options?.timeoutMs ?? this.config.timeoutMs;
         const memoryLimitBytes = options?.memoryLimitBytes ?? this.config.memoryLimitBytes;
-        const deadlineMs = Date.now() + timeoutMs;
         const logs = [];
-        const pendingDeferreds = new Set();
-        const QuickJS = await getQuickJS();
-        const runtime = QuickJS.newRuntime();
-        try {
-            runtime.setMemoryLimit(memoryLimitBytes);
-            runtime.setInterruptHandler(shouldInterruptAfterDeadline(deadlineMs));
-            const context = runtime.newContext();
+        const plugins = this.registry.listPlugins();
+        const source = buildWorkerSource(code, plugins.map((p) => p.name), buildHelpData(plugins));
+        return new Promise((resolve) => {
+            const memoryLimitMb = Math.max(8, Math.floor(memoryLimitBytes / (1024 * 1024)));
+            let worker;
             try {
-                // Inject log bridge
-                const logBridge = context.newFunction("__runline_log", (levelHandle, lineHandle) => {
-                    const level = context.getString(levelHandle);
-                    const line = context.getString(lineHandle);
-                    logs.push(`[${level}] ${line}`);
-                    return context.undefined;
+                worker = new Worker(source, {
+                    eval: true,
+                    resourceLimits: { maxOldGenerationSizeMb: memoryLimitMb },
                 });
-                context.setProp(context.global, "__runline_log", logBridge);
-                logBridge.dispose();
-                // Inject action bridge
-                const actionBridge = context.newFunction("__runline_invoke", (pathHandle, argsHandle) => {
-                    const path = context.getString(pathHandle);
-                    const args = argsHandle === undefined ||
-                        context.typeof(argsHandle) === "undefined"
-                        ? undefined
-                        : context.dump(argsHandle);
-                    const deferred = context.newPromise();
-                    pendingDeferreds.add(deferred);
-                    deferred.settled.finally(() => pendingDeferreds.delete(deferred));
-                    this.invokeAction(path, args).then((value) => {
-                        if (!deferred.alive)
-                            return;
-                        if (value === undefined) {
-                            deferred.resolve();
-                            return;
-                        }
-                        const serialized = JSON.stringify(value);
-                        const handle = context.newString(serialized);
-                        deferred.resolve(handle);
-                        handle.dispose();
-                    }, (err) => {
-                        if (!deferred.alive)
-                            return;
-                        const msg = err instanceof Error ? err.message : String(err);
-                        const handle = context.newError(msg);
-                        deferred.reject(handle);
-                        handle.dispose();
-                    });
-                    return deferred.handle;
+            }
+            catch (err) {
+                resolve({ result: null, error: formatError(err), logs });
+                return;
+            }
+            let settled = false;
+            const finish = (r) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timeoutTimer);
+                clearInterval(rssTimer);
+                void worker.terminate();
+                resolve(r);
+            };
+            const timeoutTimer = setTimeout(() => {
+                finish({
+                    result: null,
+                    error: `Execution timed out after ${timeoutMs}ms`,
+                    logs,
                 });
-                context.setProp(context.global, "__runline_invoke", actionBridge);
-                actionBridge.dispose();
-                const plugins = this.registry.listPlugins();
-                const pluginNames = plugins.map((p) => p.name);
-                const helpData = buildHelpData(plugins);
-                const source = buildExecutionSource(code, pluginNames, helpData);
-                const evaluated = context.evalCode(source, "runline-sandbox.js");
-                if (evaluated.error) {
-                    const error = context.dump(evaluated.error);
-                    evaluated.error.dispose();
-                    return { result: null, error: formatError(error), logs };
-                }
-                // Set up promise tracking
-                context.setProp(context.global, "__runline_result", evaluated.value);
-                evaluated.value.dispose();
-                const stateResult = context.evalCode(`(function(p){ var s = { v: void 0, e: void 0, settled: false };
-           var fmtErr = function(e){ if (e && typeof e === 'object') { var m = typeof e.message === 'string' ? e.message : ''; var st = typeof e.stack === 'string' ? e.stack : ''; if (m && st) return st.indexOf(m) === -1 ? m + '\\n' + st : st; if (m) return m; if (st) return st; } return String(e); };
-           p.then(function(v){ s.v = v; s.settled = true; }, function(e){ s.e = fmtErr(e); s.settled = true; }); return s; })(__runline_result)`);
-                if (stateResult.error) {
-                    const error = context.dump(stateResult.error);
-                    stateResult.error.dispose();
-                    return { result: null, error: formatError(error), logs };
-                }
-                const stateHandle = stateResult.value;
-                try {
-                    await this.drainAsync(context, runtime, pendingDeferreds, deadlineMs, timeoutMs);
-                    const settled = readProp(context, stateHandle, "settled") === true;
-                    if (!settled) {
-                        return {
+            }, timeoutMs);
+            let rssTimer;
+            if (shouldArmRssWatchdog()) {
+                const baselineRss = process.memoryUsage().rss;
+                rssTimer = setInterval(() => {
+                    const delta = process.memoryUsage().rss - baselineRss;
+                    if (delta > memoryLimitBytes + RSS_WATCHDOG_SLACK_BYTES) {
+                        finish({
                             result: null,
-                            error: `Execution timed out after ${timeoutMs}ms`,
+                            error: `Memory limit exceeded (${memoryLimitMb}MB)`,
                             logs,
-                        };
-                    }
-                    const error = readProp(context, stateHandle, "e");
-                    if (error !== undefined) {
-                        return { result: null, error: formatError(error), logs };
+                        });
                     }
-                    return { result: readProp(context, stateHandle, "v"), logs };
-                }
-                finally {
-                    stateHandle.dispose();
-                }
+                }, 100);
+                rssTimer.unref?.();
             }
-            finally {
-                for (const d of pendingDeferreds) {
-                    if (d.alive)
-                        d.dispose();
+            // A reply can race the worker's death; losing it is fine — the run is
+            // over either way — but it must never surface as an unhandled
+            // rejection in the host.
+            const reply = (message) => {
+                if (settled)
+                    return;
+                try {
+                    worker.postMessage(message);
+                }
+                catch {
+                    // worker already gone
                 }
-                pendingDeferreds.clear();
-                context.dispose();
-            }
-        }
-        catch (err) {
-            return {
-                result: null,
-                error: formatError(err),
-                logs,
             };
-        }
-        finally {
-            runtime.dispose();
-        }
+            worker.on("message", (msg) => {
+                if (settled)
+                    return;
+                if (msg.t === "log") {
+                    logs.push(`[${msg.level}] ${msg.line}`);
+                }
+                else if (msg.t === "invoke") {
+                    this.invokeAction(msg.path, msg.args).then((value) => {
+                        let serialized;
+                        try {
+                            serialized = toPlainJson(value);
+                        }
+                        catch (err) {
+                            reply({
+                                t: "result",
+                                id: msg.id,
+                                ok: false,
+                                error: `Action result not JSON-serializable: ${err instanceof Error ? err.message : String(err)}`,
+                            });
+                            return;
+                        }
+                        reply({ t: "result", id: msg.id, ok: true, value: serialized });
+                    }, (err) => {
+                        reply({
+                            t: "result",
+                            id: msg.id,
+                            ok: false,
+                            error: err instanceof Error ? err.message : String(err),
+                        });
+                    });
+                }
+                else if (msg.t === "done") {
+                    finish(msg.ok
+                        ? { result: msg.result, logs }
+                        : { result: null, error: msg.error ?? "Unknown error", logs });
+                }
+            });
+            worker.on("error", (err) => {
+                finish({
+                    result: null,
+                    error: err.code === "ERR_WORKER_OUT_OF_MEMORY"
+                        ? `Memory limit exceeded (${memoryLimitMb}MB)`
+                        : formatError(err),
+                    logs,
+                });
+            });
+            worker.on("exit", (exitCode) => {
+                finish({
+                    result: null,
+                    error: `Worker exited unexpectedly (code ${exitCode})`,
+                    logs,
+                });
+            });
+        });
     }
     async invokeAction(path, args) {
         const resolved = this.registry.resolveAction(path);
@@ -164,53 +193,17 @@ export class ExecutionEngine {
         };
         return applyEnvOverrides(base, plugin.connectionConfigSchema);
     }
-    async drainAsync(context, runtime, pendingDeferreds, deadlineMs, timeoutMs) {
-        this.drainJobs(context, runtime, deadlineMs, timeoutMs);
-        while (pendingDeferreds.size > 0) {
-            const remainingMs = deadlineMs - Date.now();
-            if (remainingMs <= 0) {
-                throw new Error(`Execution timed out after ${timeoutMs}ms`);
-            }
-            let timer;
-            try {
-                await Promise.race([
-                    Promise.race([...pendingDeferreds].map((d) => d.settled)),
-                    new Promise((_, reject) => {
-                        timer = setTimeout(() => reject(new Error(`Execution timed out after ${timeoutMs}ms`)), remainingMs);
-                    }),
-                ]);
-            }
-            finally {
-                if (timer)
-                    clearTimeout(timer);
-            }
-            this.drainJobs(context, runtime, deadlineMs, timeoutMs);
-        }
-        this.drainJobs(context, runtime, deadlineMs, timeoutMs);
-    }
-    drainJobs(context, runtime, deadlineMs, timeoutMs) {
-        while (runtime.hasPendingJob()) {
-            if (Date.now() >= deadlineMs) {
-                throw new Error(`Execution timed out after ${timeoutMs}ms`);
-            }
-            const pending = runtime.executePendingJobs();
-            if (pending.error) {
-                const error = context.dump(pending.error);
-                pending.error.dispose();
-                throw error instanceof Error ? error : new Error(String(error));
-            }
-        }
-    }
 }
 // ── Helpers ──────────────────────────────────────────────
-function readProp(context, handle, key) {
-    const prop = context.getProp(handle, key);
-    try {
-        return context.dump(prop);
-    }
-    finally {
-        prop.dispose();
-    }
+/**
+ * JSON round-trip to (a) guarantee structured-clone compatibility and
+ * (b) preserve the previous engine's value semantics, where every action
+ * result crossed a JSON boundary (Dates → ISO strings, no Maps, etc.).
+ */
+function toPlainJson(value) {
+    if (value === undefined)
+        return undefined;
+    return JSON.parse(JSON.stringify(value));
 }
 function formatError(cause) {
     if (cause instanceof Error)
@@ -224,13 +217,13 @@ function formatError(cause) {
     return String(cause);
 }
 // MiniSearch UMD bundle, vendored at the package root and inlined into the
-// sandbox source. UMD attaches `MiniSearch` to globalThis in a non-CJS /
-// non-AMD env (QuickJS), so pasting the file is enough.
+// worker source. Inside the worker it is evaluated in a local scope with a
+// fresh `module`/`exports` pair so the UMD takes its CommonJS branch.
 //
 // `../../vendor/...` resolves identically from src/core/engine.ts (dev) and
 // dist/core/engine.js (published) because tsc preserves the `core/` subdir.
 // See vendor/README.md for the upgrade procedure.
-const __minisearchSource = readFileSync(new URL("../../vendor/minisearch.umd.js", import.meta.url), "utf8");
+const minisearchSource = readFileSync(new URL("../../vendor/minisearch.umd.js", import.meta.url), "utf8");
 function buildHelpData(plugins) {
     const data = {};
     for (const p of plugins) {
@@ -242,7 +235,7 @@ function buildHelpData(plugins) {
     }
     return data;
 }
-function buildExecutionSource(code, pluginNames = [], helpData = {}) {
+function buildWorkerSource(code, pluginNames = [], helpData = {}) {
     const trimmed = code.trim();
     const looksLikeArrow = (trimmed.startsWith("async") || trimmed.startsWith("(")) &&
         trimmed.includes("=>");
@@ -250,18 +243,68 @@ function buildExecutionSource(code, pluginNames = [], helpData = {}) {
         ? `const __fn = (${trimmed});\nif (typeof __fn !== 'function') throw new Error('Code must evaluate to a function');\nreturn await __fn();`
         : code;
     const wrapped = `"use strict";
-const __invoke = __runline_invoke;
-const __log = __runline_log;
-try { delete globalThis.__runline_invoke; } catch {}
-try { delete globalThis.__runline_log; } catch {}
+const { parentPort: __port } = require("node:worker_threads");
+
+// process.exit would be runtime-divergent here: node kills the worker
+// synchronously, bun lets the completion message race the exit and can
+// report a silent undefined success. Make it a regular, catchable error.
+process.exit = (code) => {
+  throw new Error('process.exit(' + (code ?? 0) + ') is not available in the runline sandbox; return a value instead');
+};
+
+// ── host bridge ──
+let __seq = 0;
+const __pending = new Map();
+__port.on("message", (m) => {
+  if (!m || m.t !== "result") return;
+  const p = __pending.get(m.id);
+  if (!p) return;
+  __pending.delete(m.id);
+  if (m.ok) p.resolve(m.value);
+  else p.reject(new Error(m.error));
+});
+const __invoke = (path, args) => new Promise((resolve, reject) => {
+  const id = ++__seq;
+  __pending.set(id, { resolve, reject });
+  try {
+    __port.postMessage({ t: "invoke", id, path, args });
+  } catch (e) {
+    __pending.delete(id);
+    reject(e);
+  }
+});
+const __log = (level, line) => {
+  try { __port.postMessage({ t: "log", level, line }); } catch {}
+};
 
 const __fmt = (v) => {
   if (typeof v === 'string') return v;
   try { return JSON.stringify(v); } catch { return String(v); }
 };
 
-// Inlined MiniSearch UMD — attaches MiniSearch to globalThis inside the sandbox.
-${__minisearchSource}
+const __fmtErr = (e) => {
+  if (e && typeof e === 'object') {
+    const m = typeof e.message === 'string' ? e.message : '';
+    const st = typeof e.stack === 'string' ? e.stack : '';
+    if (m && st) return st.indexOf(m) === -1 ? m + '\\n' + st : st;
+    if (m) return m;
+    if (st) return st;
+  }
+  return String(e);
+};
+
+// JSON round-trip mirrors the host's toPlainJson: keeps results
+// structured-clone-safe and preserves JSON value semantics.
+const __toJson = (v) => v === undefined ? undefined : JSON.parse(JSON.stringify(v));
+
+// Inlined MiniSearch UMD, evaluated with a local module/exports so the UMD
+// takes its CommonJS branch regardless of the worker's module scope.
+const MiniSearch = (function () {
+  const module = { exports: {} };
+  const exports = module.exports;
+  ${minisearchSource}
+  return module.exports;
+})();
 
 const __help = ${JSON.stringify(helpData)};
 
@@ -273,8 +316,7 @@ const __makeProxy = (path = []) => new Proxy(() => undefined, {
   apply(_t, _this, args) {
     const p = path.join('.');
     if (!p) throw new Error('Action path missing');
-    return Promise.resolve(__invoke(p, args[0]))
-      .then((raw) => raw === undefined ? undefined : JSON.parse(raw));
+    return __invoke(p, args[0]);
   },
 });
 
@@ -296,7 +338,7 @@ const __formatSignature = (plugin, entry) => {
   return plugin + '.' + entry.action + (fields ? '({ ' + fields + ' })' : '()');
 };
 
-// Build a MiniSearch index over every action path. Indexed at sandbox
+// Build a MiniSearch index over every action path. Indexed at worker
 // startup, queried by actions.find().
 const __search = (() => {
   const docs = [];
@@ -416,6 +458,18 @@ const fetch = () => { throw new Error('fetch is disabled in runline sandbox'); }
 
 (async () => {
 ${body}
-})()`;
+})().then(
+  (v) => {
+    try {
+      __port.postMessage({ t: "done", ok: true, result: __toJson(v) });
+    } catch (e) {
+      __port.postMessage({ t: "done", ok: false, error: __fmtErr(e) });
+    }
+  },
+  (e) => {
+    __port.postMessage({ t: "done", ok: false, error: __fmtErr(e) });
+  },
+);
+`;
     return wrapped;
 }

package/dist/tests/helpers/engine-harness.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/helpers/engine-harness.js

@@ -0,0 +1,236 @@
+// Test harness for engine robustness scenarios (large payloads, OOM,
+// timeouts, crashes). Runs one named scenario in this process and prints a
+// JSON report to stdout. Tests spawn this file so that a hard process
+// abort or exit kills the harness, not the test runner.
+//
+// Usage: bun run engine-harness.ts <scenario>
+import { createHash } from "node:crypto";
+import { DEFAULT_CONFIG } from "../../config/types.js";
+import { ExecutionEngine } from "../../core/engine.js";
+import { createPluginAPI } from "../../plugin/api.js";
+import { PluginRegistry } from "../../plugin/registry.js";
+const BLOB_MB = 8;
+// ~8MB of raw bytes → ~10.7MB base64
+const base64 = Buffer.alloc(BLOB_MB * 1024 * 1024, 0xab).toString("base64");
+const base64Sha = createHash("sha256").update(base64).digest("hex");
+// Captures what the host-side actions actually received, so tests can
+// verify that data crossing the execution boundary arrives byte-identical.
+const received = {};
+function makeFilesPlugin() {
+    const { api, resolve } = createPluginAPI("test");
+    api.setName("files");
+    api.setVersion("0.0.0");
+    api.registerAction("getAttachment", {
+        description: "Returns a large base64 payload",
+        async execute() {
+            await new Promise((r) => setTimeout(r, 5));
+            return { filename: "msa.pdf", data: base64 };
+        },
+    });
+    api.registerAction("upload", {
+        description: "Accepts a large base64 payload",
+        async execute(input) {
+            await new Promise((r) => setTimeout(r, 5));
+            const { data } = input;
+            received.uploadSha =
+                typeof data === "string"
+                    ? createHash("sha256").update(data).digest("hex")
+                    : `not-a-string:${typeof data}`;
+            received.uploadBytes = typeof data === "string" ? data.length : -1;
+            return { id: "file_123", bytes: received.uploadBytes };
+        },
+    });
+    api.registerAction("send", {
+        description: "Accepts a large attachment",
+        async execute(input) {
+            await new Promise((r) => setTimeout(r, 5));
+            const { attachment } = input;
+            received.sendBytes =
+                typeof attachment === "string" ? attachment.length : -1;
+            return { messageId: "msg_456", bytes: received.sendBytes };
+        },
+    });
+    api.registerAction("append", {
+        description: "Small side effect",
+        async execute() {
+            await new Promise((r) => setTimeout(r, 5));
+            return { updatedRows: 1 };
+        },
+    });
+    api.registerAction("slow", {
+        description: "Sleeps for the given ms, then returns",
+        async execute(input) {
+            const { ms } = input;
+            await new Promise((r) => setTimeout(r, ms));
+            return { waited: ms };
+        },
+    });
+    api.registerAction("circular", {
+        description: "Returns a non-JSON-serializable (circular) value",
+        async execute() {
+            const obj = { name: "loop" };
+            obj.self = obj;
+            return obj;
+        },
+    });
+    return resolve();
+}
+function makeEngine(memoryMb = 64, timeoutMs = 30_000) {
+    const registry = new PluginRegistry();
+    registry.register(makeFilesPlugin());
+    return new ExecutionEngine(registry, {
+        ...DEFAULT_CONFIG,
+        timeoutMs,
+        memoryLimitBytes: memoryMb * 1024 * 1024,
+    });
+}
+const scenarios = {
+    // The agent's original failure: multi-step chain with a large payload,
+    // default 64MB memory limit. Must complete cleanly.
+    async "chain-default"() {
+        const engine = makeEngine(64);
+        const out = await engine.execute(`
+      const att = await files.getAttachment({ messageId: "m1" });
+      const up = await files.upload({ name: att.filename, data: att.data });
+      const sent = await files.send({ to: "x@y.z", attachment: att.data });
+      const row = await files.append({ values: [["Triple-A MSA", "May"]] });
+      return { up, sent, row };
+    `);
+        return { error: out.error ?? null, result: out.result, received };
+    },
+    // Integrity: the bytes the upload action receives must be byte-identical
+    // to what getAttachment produced.
+    async integrity() {
+        const engine = makeEngine(64);
+        const out = await engine.execute(`
+      const att = await files.getAttachment({ messageId: "m1" });
+      await files.upload({ name: att.filename, data: att.data });
+      return "done";
+    `);
+        return {
+            error: out.error ?? null,
+            expectedSha: base64Sha,
+            expectedBytes: base64.length,
+            received,
+        };
+    },
+    // Ergonomics: inside the sandbox a large payload is a plain string the
+    // agent can measure, slice, and pass around — no tokens, no proxies.
+    async "string-surface"() {
+        const engine = makeEngine(64);
+        const out = await engine.execute(`
+      const att = await files.getAttachment({ messageId: "m1" });
+      const d = att.data;
+      return { type: typeof d, bytes: d.length, head: d.slice(0, 8) };
+    `);
+        return {
+            error: out.error ?? null,
+            result: out.result,
+            expectedBytes: base64.length,
+            expectedHead: base64.slice(0, 8),
+        };
+    },
+    // A large value in the final return reaches the host caller intact.
+    async "final-result-large"() {
+        const engine = makeEngine(64);
+        const out = await engine.execute(`
+      const att = await files.getAttachment({ messageId: "m1" });
+      return { data: att.data };
+    `);
+        const data = out.result?.data;
+        return {
+            error: out.error ?? null,
+            resultBytes: typeof data === "string" ? data.length : -1,
+            resultSha: typeof data === "string"
+                ? createHash("sha256").update(data).digest("hex")
+                : null,
+            expectedSha: base64Sha,
+            expectedBytes: base64.length,
+        };
+    },
+    // An action still in flight when the run times out must not crash the
+    // host when its result arrives after the worker is gone — no unhandled
+    // rejections, no uncaught exceptions, clean timeout error.
+    async "timeout-inflight-action"() {
+        const unhandled = [];
+        process.on("unhandledRejection", (e) => unhandled.push(String(e)));
+        process.on("uncaughtException", (e) => unhandled.push(String(e)));
+        const engine = makeEngine(64, 150);
+        const out = await engine.execute(`
+      await files.slow({ ms: 1000 });
+      return "unreachable";
+    `);
+        // let the in-flight action resolve against the dead worker
+        await new Promise((r) => setTimeout(r, 1200));
+        return { error: out.error ?? null, unhandled };
+    },
+    // An action returning a non-JSON-serializable value must surface as a
+    // clean per-call error inside the sandbox — catchable by agent code —
+    // not a hang or a crash.
+    async "circular-result"() {
+        const engine = makeEngine(64);
+        const out = await engine.execute(`
+      try {
+        await files.circular({});
+        return { caught: false };
+      } catch (e) {
+        return { caught: true, message: e.message };
+      }
+    `);
+        return { error: out.error ?? null, result: out.result };
+    },
+    // Two executes on the same engine running concurrently must not
+    // interfere — separate workers, separate logs, correct results.
+    async concurrent() {
+        const engine = makeEngine(64);
+        const [a, b] = await Promise.all([
+            engine.execute(`console.log("run-a"); const r = await files.slow({ ms: 50 }); return { tag: "a", waited: r.waited };`),
+            engine.execute(`console.log("run-b"); const r = await files.slow({ ms: 30 }); return { tag: "b", waited: r.waited };`),
+        ]);
+        return {
+            aError: a.error ?? null,
+            bError: b.error ?? null,
+            aResult: a.result,
+            bResult: b.result,
+            aLogs: a.logs,
+            bLogs: b.logs,
+        };
+    },
+    // Agent code killing its own worker (it has the full runtime, so it can)
+    // must fail soft with a descriptive error and leave the engine usable.
+    async "worker-suicide"() {
+        const engine = makeEngine(64);
+        const out = await engine.execute(`process.exit(7);`);
+        const after = await engine.execute("return 1 + 1");
+        return {
+            error: out.error ?? null,
+            afterError: after.error ?? null,
+            afterResult: after.result,
+        };
+    },
+    // Sandbox code that genuinely exhausts the memory limit must fail soft:
+    // a clean error returned from execute(), no process abort, and the engine
+    // must remain usable for a subsequent run.
+    async "sandbox-oom"() {
+        const engine = makeEngine(32);
+        const out = await engine.execute(`
+      const hog = [];
+      while (true) hog.push(new Array(1e6).fill(1));
+    `);
+        const after = await engine.execute("return 1 + 1");
+        return {
+            error: out.error ?? null,
+            afterError: after.error ?? null,
+            afterResult: after.result,
+        };
+    },
+};
+const name = process.argv[2];
+const scenario = scenarios[name];
+if (!scenario) {
+    console.error(`Unknown scenario: ${name}`);
+    process.exit(2);
+}
+const report = await scenario();
+console.log(JSON.stringify(report));
+process.exit(0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runline",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Code mode for agents — turn any API or command into a callable action",
   "type": "module",
   "main": "dist/index.js",
@@ -75,7 +75,6 @@
     "commander": "^14.0.3",
     "jiti": "^2.7.0",
     "proper-lockfile": "^4.1.2",
-    "quickjs-emscripten": "^0.32.0",
     "rrule": "^2.8.1",
     "typebox": "^1.1.35"
   }