runline 0.34.0 → 0.36.0

package/dist/plugins/vonage/src/credentials.js

@@ -1,4 +1,4 @@
-import { staticCredential } from "../../_shared/credentials.js";
+import { staticCredential } from "runline";
 /** An API key and secret, added by the transport as the api_key and api_secret fields of Vonage's SMS form. */
 export const vonageCredential = staticCredential({
     id: "vonage",

package/dist/plugins/vonage/src/index.js

@@ -1,4 +1,4 @@
-import { credentialJson } from "../../_shared/credentials.js";
+import { credentialJson } from "runline";
 import { vonageCredential } from "./credentials.js";
 export default function vonage(rl) {
     rl.setName("vonage");

package/dist/plugins/wekan/src/credentials.js

@@ -1,4 +1,4 @@
-import { httpsBase, staticCredential } from "../../_shared/credentials.js";
+import { httpsBase, staticCredential } from "runline";
 /**
  * A login token, sent as a bearer to the /api surface of the
  * connection's own Wekan server.

package/dist/plugins/wekan/src/index.js

@@ -1,4 +1,4 @@
-import { credentialJson, pathSegment } from "../../_shared/credentials.js";
+import { credentialJson, pathSegment, } from "runline";
 import { wekanCredential } from "./credentials.js";
 function api(ctx, method, endpoint, body) {
     return credentialJson(ctx, wekanCredential, "wekan", {

package/dist/plugins/wolt/src/account.js

@@ -1,4 +1,4 @@
-import { refuseUnderHost } from "../../_shared/credentials.js";
+import { refuseUnderHost } from "runline";
 import { AUDIENCE, AUTH, arr, authed, CAPABILITIES, CONSUMER, cfgOf, clientHeaders, ensureIdentity, expiresAt, formEncode, http, normPhone, obj, pick, RESTAURANT, WoltError, } from "./shared.js";
 async function authJson(ctx, path, body, extra = {}) {
     return http(AUTH, path, {

package/dist/plugins/wolt/src/credentials.js

@@ -1,4 +1,4 @@
-import { grantSchema } from "../../_shared/credentials.js";
+import { grantSchema, } from "runline";
 export const RESTAURANT = "restaurant-api.wolt.com";
 export const CONSUMER = "consumer-api.wolt.com";
 export const AUTH = "authentication.wolt.com";

package/dist/plugins/wolt/src/index.js

@@ -1,5 +1,5 @@
+import { refuseUnderHost, } from "runline";
 import * as t from "typebox";
-import { refuseUnderHost } from "../../_shared/credentials.js";
 import { discoverPaymentMethod, listAddresses, loginMethods, redeemLink, requestEmailCode, requestSmsCode, status, submitCode, submitConfirmation, whoami, } from "./account.js";
 import { item, menu, nearby, search, venue } from "./catalog.js";
 import { woltCredential } from "./credentials.js";

package/dist/plugins/wolt/src/shared.js

@@ -1,6 +1,5 @@
 import { randomUUID } from "node:crypto";
-import { AuthError } from "runline";
-import { credentialRequest, pathSegment } from "../../_shared/credentials.js";
+import { AuthError, credentialRequest, pathSegment, } from "runline";
 import { arr, num, numOrNull, obj, pick } from "../../_shared/provider.js";
 import { CONSUMER, clientHeaders, RESTAURANT, woltCredential, } from "./credentials.js";
 import { answerOf, endpointOf } from "./public.js";

package/dist/plugins/woocommerce/src/credentials.js

@@ -1,4 +1,4 @@
-import { httpsBase, staticCredential } from "../../_shared/credentials.js";
+import { httpsBase, staticCredential } from "runline";
 /**
  * The store's consumer key and secret as a Basic pair, beneath the
  * connection's own store URL. The store must be HTTPS.

package/dist/plugins/woocommerce/src/index.js

@@ -1,4 +1,4 @@
-import { credentialJson, pathSegment } from "../../_shared/credentials.js";
+import { credentialJson, pathSegment, } from "runline";
 import { woocommerceCredential } from "./credentials.js";
 function apiRequest(ctx, method, path, body, qs) {
     return credentialJson(ctx, woocommerceCredential, "woocommerce", {

package/dist/plugins/wordpress/src/credentials.js

@@ -1,4 +1,4 @@
-import { httpsBase, staticCredential } from "../../_shared/credentials.js";
+import { httpsBase, staticCredential } from "runline";
 /**
  * A user's application password as the Basic pair, on the connection's own
  * site beneath /wp-json/wp/v2/.

package/dist/plugins/wordpress/src/index.js

@@ -1,4 +1,4 @@
-import { credentialJson, pathSegment } from "../../_shared/credentials.js";
+import { credentialJson, pathSegment, } from "runline";
 import { wordpressCredential } from "./credentials.js";
 async function apiRequest(ctx, method, path, body, qs) {
     return credentialJson(ctx, wordpressCredential, "wordpress", {

package/dist/plugins/xai/src/credentials.js

@@ -1,4 +1,4 @@
-import { staticCredential } from "../../_shared/credentials.js";
+import { staticCredential } from "runline";
 /** An API key, sent as a bearer to xAI's one API origin. */
 export const xaiCredential = staticCredential({
     id: "xai",

package/dist/plugins/xai/src/index.js

@@ -8,7 +8,7 @@
  * text rendering well. Sized via aspect_ratio rather than W×H —
  * the API does the math.
  */
-import { credentialJson } from "../../_shared/credentials.js";
+import { credentialJson } from "runline";
 import { readImageInput, SEND_FILE_NOTE, writeImageFile, } from "../../_shared/mediaFile.js";
 import { xaiCredential } from "./credentials.js";
 const MODEL = "grok-imagine-image";
@@ -119,7 +119,7 @@ export default function xai(rl) {
             if (typeof p.prompt !== "string" || p.prompt.length === 0) {
                 throw new Error("xai: prompt is required");
             }
-            const img = readImageInput(p.imagePath, "xai");
+            const img = await readImageInput(p.imagePath, "xai");
             const model = p.model ?? EDIT_MODEL;
             const data = (await credentialJson(ctx, xaiCredential, "xai", {
                 target: "api",

package/dist/plugins/xero/src/credentials.js

@@ -1,4 +1,4 @@
-import { staticCredential } from "../../_shared/credentials.js";
+import { staticCredential } from "runline";
 /**
  * An OAuth2 access token, sent as a bearer to Xero's accounting API. The
  * public Xero-tenant-id companion header names the organization.

package/dist/plugins/xero/src/index.js

@@ -1,4 +1,4 @@
-import { credentialJson, pathSegment } from "../../_shared/credentials.js";
+import { credentialJson, pathSegment, } from "runline";
 import { xeroCredential } from "./credentials.js";
 function api(ctx, method, endpoint, body, qs) {
     return credentialJson(ctx, xeroCredential, "xero", {

package/dist/plugins/yourls/src/credentials.js

@@ -1,4 +1,4 @@
-import { httpsBase, staticCredential } from "../../_shared/credentials.js";
+import { httpsBase, staticCredential } from "runline";
 /**
  * A signature token, appended by the transport as the signature query
  * parameter on the installation's own yourls-api.php. The installation

package/dist/plugins/yourls/src/index.js

@@ -1,4 +1,4 @@
-import { answerFailed, credentialJson } from "../../_shared/credentials.js";
+import { answerFailed, credentialJson, } from "runline";
 import { yourlsCredential } from "./credentials.js";
 async function apiRequest(ctx, qs) {
     const data = (await credentialJson(ctx, yourlsCredential, "yourls", {

package/dist/plugins/zammad/src/credentials.js

@@ -1,4 +1,4 @@
-import { httpsBase, staticCredential } from "../../_shared/credentials.js";
+import { httpsBase, staticCredential } from "runline";
 /** An access token, sent as `Authorization: Token token={token}` to the
  *  connection's own Zammad instance beneath /api/v1/. The instance URL is
  *  public config and must be HTTPS. */

package/dist/plugins/zammad/src/index.js

@@ -1,4 +1,4 @@
-import { credentialJson, pathSegment } from "../../_shared/credentials.js";
+import { credentialJson, pathSegment, } from "runline";
 import { zammadCredential } from "./credentials.js";
 async function api(ctx, method, endpoint, body, qs) {
     return credentialJson(ctx, zammadCredential, "zammad", {

package/dist/plugins/zendesk/src/credentials.js

@@ -1,4 +1,4 @@
-import { hostLabel, staticCredential } from "../../_shared/credentials.js";
+import { hostLabel, staticCredential } from "runline";
 /**
  * An API token as the Basic password, with the agent email joined to the
  * fixed /token suffix as the username, on the account's own Zendesk

package/dist/plugins/zendesk/src/index.js

@@ -1,4 +1,4 @@
-import { credentialJson, pathSegment } from "../../_shared/credentials.js";
+import { credentialJson, pathSegment, } from "runline";
 import { zendeskCredential } from "./credentials.js";
 /** One Zendesk call: every endpoint is a .json path beneath /api/v2/. */
 function api(ctx, method, endpoint, body, qs) {

package/dist/plugins/zoho/src/credentials.js

@@ -1,4 +1,4 @@
-import { httpsBase, staticCredential } from "../../_shared/credentials.js";
+import { httpsBase, staticCredential } from "runline";
 /**
  * An OAuth2 access token, sent as `Authorization: Zoho-oauthtoken …` to the
  * CRM API on the connection's data-center domain.

package/dist/plugins/zoho/src/index.js

@@ -1,4 +1,4 @@
-import { credentialJson, pathSegment } from "../../_shared/credentials.js";
+import { credentialJson, pathSegment, } from "runline";
 import { zohoCredential } from "./credentials.js";
 function api(ctx, method, endpoint, body, qs) {
     return credentialJson(ctx, zohoCredential, "zoho", {

package/dist/plugins/zoom/src/credentials.js

@@ -1,4 +1,4 @@
-import { staticCredential } from "../../_shared/credentials.js";
+import { staticCredential } from "runline";
 /** An access token, sent as a bearer to Zoom's one API origin. */
 export const zoomCredential = staticCredential({
     id: "zoom",

package/dist/plugins/zoom/src/index.js

@@ -1,4 +1,4 @@
-import { credentialJson, pathSegment } from "../../_shared/credentials.js";
+import { credentialJson, pathSegment, } from "runline";
 import { zoomCredential } from "./credentials.js";
 async function apiRequest(ctx, method, path, body, qs) {
     return credentialJson(ctx, zoomCredential, "zoom", {

package/dist/plugins/zulip/src/credentials.js

@@ -1,4 +1,4 @@
-import { httpsBase, staticCredential } from "../../_shared/credentials.js";
+import { httpsBase, staticCredential } from "runline";
 /**
  * The bot's email and API key as a Basic pair, beneath the connection's
  * own Zulip server. The server must be HTTPS.

package/dist/plugins/zulip/src/index.js

@@ -1,4 +1,4 @@
-import { credentialJson, pathSegment } from "../../_shared/credentials.js";
+import { credentialJson, pathSegment, } from "runline";
 import { zulipCredential } from "./credentials.js";
 /** Zulip takes form-encoded parameters; nested values are JSON strings. */
 function zulipParams(body) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "runline",
-  "version": "0.34.0",
-  "description": "Code mode for agents \u2014 turn any API or command into a callable action",
+  "version": "0.36.0",
+  "description": "Code mode for agents — turn any API or command into a callable action",
   "type": "module",
   "main": "dist/index.js",
   "exports": {
@@ -32,6 +32,7 @@
     "prepublishOnly": "bun run build",
     "dev": "bun run src/main.ts",
     "test": "bun test src/tests",
+    "typecheck": "tsc --noEmit && tsc -p tsconfig.test.json",
     "format": "bunx @biomejs/biome format --write src/",
     "lint": "bunx @biomejs/biome lint src/",
     "check": "bunx @biomejs/biome check src/"
@@ -92,6 +93,7 @@
     "@shift-labs/ferrosearch": "^0.1.0",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
+    "fast-xml-parser": "^5.11.2",
     "jiti": "^2.7.0",
     "proper-lockfile": "^4.1.2",
     "rrule": "^2.8.1",

package/dist/plugins/_shared/credentialAdapter.js

@@ -1,152 +0,0 @@
-import { createHash } from "node:crypto";
-import { AuthError, CredentialRegistry, CredentialTransport, } from "runline";
-/**
- * Where one action call's authenticated requests go: the host's broker
- * when it supplies one — the credentials then live with the host, and no
- * local signer is built — else this process signs with its own
- * connection, from the plugin's declaration.
- */
-export function credentialBroker(ctx, declaration) {
-    if (ctx.credentials)
-        return ctx.credentials;
-    const { binding, transport } = localSigner(ctx, declaration);
-    return {
-        request: (input) => transport.request(binding, input),
-        probe: () => transport.probe(binding),
-        socketUrl: (input) => transport.socketUrl(binding, input),
-    };
-}
-/** Everything a stored token was issued under. A config whose selection
- *  hashes differently can no longer use tokens issued for this one. */
-function authorityOf(selection) {
-    return createHash("sha256").update(JSON.stringify(selection)).digest("hex");
-}
-/**
- * A static secret's structured shape, from the flat fields and fixed values
- * the declaration names, joined in order where a part concatenates them.
- * Absent when a required part's field is missing, so the transport refuses
- * it as invalid_credentials before any IO; a missing optional part is left
- * out, refusing only the targets that place it.
- */
-function staticSecret(current, sources, optional) {
-    if (!sources)
-        return undefined;
-    const secret = {};
-    sources: for (const [key, source] of Object.entries(sources)) {
-        let joined = "";
-        for (const part of "concat" in source ? source.concat : [source]) {
-            const value = "value" in part ? part.value : current[part.field];
-            if (typeof value !== "string") {
-                if (optional.includes(key))
-                    continue sources;
-                return undefined;
-            }
-            joined += value;
-        }
-        secret[key] = joined;
-    }
-    return secret;
-}
-/**
- * This process signing with its own connection. Flat CLI/env storage is a
- * projection, not a second token cache or refresh engine.
- */
-function localSigner(ctx, declaration) {
-    const selection = declaration(ctx.connection.config);
-    const { type: definition, method } = selection;
-    if (!Object.hasOwn(definition.methods, method))
-        throw new AuthError("invalid_definition");
-    const auth = definition.methods[method].authentication;
-    const identity = { name: ctx.connection.name, plugin: ctx.connection.plugin };
-    const expected = authorityOf(selection);
-    const project = (current) => {
-        if (authorityOf(declaration(current)) !== expected)
-            throw new AuthError("binding_changed");
-        if (auth.kind === "none")
-            return {};
-        if (auth.kind === "static") {
-            const secret = staticSecret(current, selection.localSecret, auth.optionalParts ?? []);
-            return secret ? { [auth.field]: secret } : {};
-        }
-        const compatible = current.authTokenBinding === undefined ||
-            current.authTokenBinding === expected;
-        const tokens = {
-            ...(compatible && current.accessToken !== undefined
-                ? { accessToken: current.accessToken }
-                : {}),
-            ...(current.refreshToken !== undefined
-                ? { refreshToken: current.refreshToken }
-                : {}),
-            ...(compatible && current.accessTokenExpiresAt !== undefined
-                ? { expiresAt: current.accessTokenExpiresAt }
-                : {}),
-            ...(compatible && current.authTokenScope !== undefined
-                ? { scope: current.authTokenScope }
-                : {}),
-            ...(compatible && current.authTokenType !== undefined
-                ? { tokenType: current.authTokenType }
-                : {}),
-        };
-        if (!Object.keys(tokens).length)
-            return {};
-        const revision = typeof current.authTokenRevision === "string" && compatible
-            ? current.authTokenRevision
-            : createHash("sha256").update(JSON.stringify(tokens)).digest("hex");
-        return { [auth.field]: { tokens, revision } };
-    };
-    const snapshot = () => ({
-        ...identity,
-        config: project(ctx.connection.config),
-    });
-    const binding = {
-        type: definition.id,
-        method,
-        identity,
-        application: selection.application,
-        ...(selection.jwtIdentity ? { jwtIdentity: selection.jwtIdentity } : {}),
-        ...(selection.resourceOwner
-            ? { resourceOwner: selection.resourceOwner }
-            : {}),
-        connection: {
-            async read() {
-                return snapshot();
-            },
-            async update(change) {
-                // Only an OAuth grant is ever renewed and written back.
-                if (auth.kind !== "oauth2")
-                    throw new AuthError("invalid_definition");
-                await ctx.updateConnection(async (current) => {
-                    const projected = project(current);
-                    const patch = typeof change === "function" ? await change(projected) : change;
-                    if (!patch)
-                        return;
-                    const grant = patch[auth.field];
-                    if (!grant?.tokens.accessToken)
-                        throw new AuthError("invalid_credentials");
-                    return {
-                        accessToken: grant.tokens.accessToken,
-                        accessTokenExpiresAt: grant.tokens.expiresAt,
-                        refreshToken: grant.tokens.refreshToken ?? current.refreshToken,
-                        authTokenScope: grant.tokens.scope,
-                        authTokenType: grant.tokens.tokenType,
-                        authTokenRevision: grant.revision,
-                        authTokenBinding: expected,
-                    };
-                });
-                return snapshot();
-            },
-        },
-    };
-    const registry = new CredentialRegistry();
-    registry.register(definition);
-    // The widest defaults the transport allows, so an undeclared slow call
-    // (image generation, exports) is bounded rather than cut short; targets
-    // that declare their own deadline or ceiling get it up to the host caps.
-    const transport = new CredentialTransport(registry, {
-        fetch: globalThis.fetch,
-        timeoutMs: 120_000,
-        maxRequestBytes: 64 * 1024 * 1024,
-        maxResponseBytes: 64 * 1024 * 1024,
-    });
-    return { binding, transport };
-}

package/dist/tests/helpers/engine-harness.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/tests/helpers/engine-harness.js

@@ -1,236 +0,0 @@
-// Test harness for engine robustness scenarios (large payloads, OOM,
-// timeouts, crashes). Runs one named scenario in this process and prints a
-// JSON report to stdout. Tests spawn this file so that a hard process
-// abort or exit kills the harness, not the test runner.
-//
-// Usage: bun run engine-harness.ts <scenario>
-import { createHash } from "node:crypto";
-import { DEFAULT_CONFIG } from "../../config/types.js";
-import { ExecutionEngine } from "../../core/engine.js";
-import { createPluginAPI } from "../../plugin/api.js";
-import { PluginRegistry } from "../../plugin/registry.js";
-const BLOB_MB = 8;
-// ~8MB of raw bytes → ~10.7MB base64
-const base64 = Buffer.alloc(BLOB_MB * 1024 * 1024, 0xab).toString("base64");
-const base64Sha = createHash("sha256").update(base64).digest("hex");
-// Captures what the host-side actions actually received, so tests can
-// verify that data crossing the execution boundary arrives byte-identical.
-const received = {};
-function makeFilesPlugin() {
-    const { api, resolve } = createPluginAPI("test");
-    api.setName("files");
-    api.setVersion("0.0.0");
-    api.registerAction("getAttachment", {
-        description: "Returns a large base64 payload",
-        async execute() {
-            await new Promise((r) => setTimeout(r, 5));
-            return { filename: "msa.pdf", data: base64 };
-        },
-    });
-    api.registerAction("upload", {
-        description: "Accepts a large base64 payload",
-        async execute(input) {
-            await new Promise((r) => setTimeout(r, 5));
-            const { data } = input;
-            received.uploadSha =
-                typeof data === "string"
-                    ? createHash("sha256").update(data).digest("hex")
-                    : `not-a-string:${typeof data}`;
-            received.uploadBytes = typeof data === "string" ? data.length : -1;
-            return { id: "file_123", bytes: received.uploadBytes };
-        },
-    });
-    api.registerAction("send", {
-        description: "Accepts a large attachment",
-        async execute(input) {
-            await new Promise((r) => setTimeout(r, 5));
-            const { attachment } = input;
-            received.sendBytes =
-                typeof attachment === "string" ? attachment.length : -1;
-            return { messageId: "msg_456", bytes: received.sendBytes };
-        },
-    });
-    api.registerAction("append", {
-        description: "Small side effect",
-        async execute() {
-            await new Promise((r) => setTimeout(r, 5));
-            return { updatedRows: 1 };
-        },
-    });
-    api.registerAction("slow", {
-        description: "Sleeps for the given ms, then returns",
-        async execute(input) {
-            const { ms } = input;
-            await new Promise((r) => setTimeout(r, ms));
-            return { waited: ms };
-        },
-    });
-    api.registerAction("circular", {
-        description: "Returns a non-JSON-serializable (circular) value",
-        async execute() {
-            const obj = { name: "loop" };
-            obj.self = obj;
-            return obj;
-        },
-    });
-    return resolve();
-}
-function makeEngine(memoryMb = 64, timeoutMs = 30_000) {
-    const registry = new PluginRegistry();
-    registry.register(makeFilesPlugin());
-    return new ExecutionEngine(registry, {
-        ...DEFAULT_CONFIG,
-        timeoutMs,
-        memoryLimitBytes: memoryMb * 1024 * 1024,
-    });
-}
-const scenarios = {
-    // The agent's original failure: multi-step chain with a large payload,
-    // default 64MB memory limit. Must complete cleanly.
-    async "chain-default"() {
-        const engine = makeEngine(64);
-        const out = await engine.execute(`
-      const att = await files.getAttachment({ messageId: "m1" });
-      const up = await files.upload({ name: att.filename, data: att.data });
-      const sent = await files.send({ to: "x@y.z", attachment: att.data });
-      const row = await files.append({ values: [["Triple-A MSA", "May"]] });
-      return { up, sent, row };
-    `);
-        return { error: out.error ?? null, result: out.result, received };
-    },
-    // Integrity: the bytes the upload action receives must be byte-identical
-    // to what getAttachment produced.
-    async integrity() {
-        const engine = makeEngine(64);
-        const out = await engine.execute(`
-      const att = await files.getAttachment({ messageId: "m1" });
-      await files.upload({ name: att.filename, data: att.data });
-      return "done";
-    `);
-        return {
-            error: out.error ?? null,
-            expectedSha: base64Sha,
-            expectedBytes: base64.length,
-            received,
-        };
-    },
-    // Ergonomics: inside the sandbox a large payload is a plain string the
-    // agent can measure, slice, and pass around — no tokens, no proxies.
-    async "string-surface"() {
-        const engine = makeEngine(64);
-        const out = await engine.execute(`
-      const att = await files.getAttachment({ messageId: "m1" });
-      const d = att.data;
-      return { type: typeof d, bytes: d.length, head: d.slice(0, 8) };
-    `);
-        return {
-            error: out.error ?? null,
-            result: out.result,
-            expectedBytes: base64.length,
-            expectedHead: base64.slice(0, 8),
-        };
-    },
-    // A large value in the final return reaches the host caller intact.
-    async "final-result-large"() {
-        const engine = makeEngine(64);
-        const out = await engine.execute(`
-      const att = await files.getAttachment({ messageId: "m1" });
-      return { data: att.data };
-    `);
-        const data = out.result?.data;
-        return {
-            error: out.error ?? null,
-            resultBytes: typeof data === "string" ? data.length : -1,
-            resultSha: typeof data === "string"
-                ? createHash("sha256").update(data).digest("hex")
-                : null,
-            expectedSha: base64Sha,
-            expectedBytes: base64.length,
-        };
-    },
-    // An action still in flight when the run times out must not crash the
-    // host when its result arrives after the worker is gone — no unhandled
-    // rejections, no uncaught exceptions, clean timeout error.
-    async "timeout-inflight-action"() {
-        const unhandled = [];
-        process.on("unhandledRejection", (e) => unhandled.push(String(e)));
-        process.on("uncaughtException", (e) => unhandled.push(String(e)));
-        const engine = makeEngine(64, 150);
-        const out = await engine.execute(`
-      await files.slow({ ms: 1000 });
-      return "unreachable";
-    `);
-        // let the in-flight action resolve against the dead worker
-        await new Promise((r) => setTimeout(r, 1200));
-        return { error: out.error ?? null, unhandled };
-    },
-    // An action returning a non-JSON-serializable value must surface as a
-    // clean per-call error inside the sandbox — catchable by agent code —
-    // not a hang or a crash.
-    async "circular-result"() {
-        const engine = makeEngine(64);
-        const out = await engine.execute(`
-      try {
-        await files.circular({});
-        return { caught: false };
-      } catch (e) {
-        return { caught: true, message: e.message };
-      }
-    `);
-        return { error: out.error ?? null, result: out.result };
-    },
-    // Two executes on the same engine running concurrently must not
-    // interfere — separate workers, separate logs, correct results.
-    async concurrent() {
-        const engine = makeEngine(64);
-        const [a, b] = await Promise.all([
-            engine.execute(`console.log("run-a"); const r = await files.slow({ ms: 50 }); return { tag: "a", waited: r.waited };`),
-            engine.execute(`console.log("run-b"); const r = await files.slow({ ms: 30 }); return { tag: "b", waited: r.waited };`),
-        ]);
-        return {
-            aError: a.error ?? null,
-            bError: b.error ?? null,
-            aResult: a.result,
-            bResult: b.result,
-            aLogs: a.logs,
-            bLogs: b.logs,
-        };
-    },
-    // Agent code killing its own worker (it has the full runtime, so it can)
-    // must fail soft with a descriptive error and leave the engine usable.
-    async "worker-suicide"() {
-        const engine = makeEngine(64);
-        const out = await engine.execute(`process.exit(7);`);
-        const after = await engine.execute("return 1 + 1");
-        return {
-            error: out.error ?? null,
-            afterError: after.error ?? null,
-            afterResult: after.result,
-        };
-    },
-    // Sandbox code that genuinely exhausts the memory limit must fail soft:
-    // a clean error returned from execute(), no process abort, and the engine
-    // must remain usable for a subsequent run.
-    async "sandbox-oom"() {
-        const engine = makeEngine(32);
-        const out = await engine.execute(`
-      const hog = [];
-      while (true) hog.push(new Array(1e6).fill(1));
-    `);
-        const after = await engine.execute("return 1 + 1");
-        return {
-            error: out.error ?? null,
-            afterError: after.error ?? null,
-            afterResult: after.result,
-        };
-    },
-};
-const name = process.argv[2];
-const scenario = scenarios[name];
-if (!scenario) {
-    console.error(`Unknown scenario: ${name}`);
-    process.exit(2);
-}
-const report = await scenario();
-console.log(JSON.stringify(report));
-process.exit(0);