@sema-agent/core/dist/orchestration/dev-vm-script-runner.d.ts

Stateless, task-oriented AI agent core

/**
 * design/98 §2.2 (S8b) — a `WorkflowScriptRunner` backed by Node's `vm`, for TRUSTED, DEVELOPER-authored
 * workflow scripts ONLY.
 *
 * 🔴🔴 NOT A SECURITY BOUNDARY. Node `vm` does NOT isolate untrusted code: a script can reach the host realm
 * through the prototype chain of ANY injected host object —
 *   `agent.constructor.constructor("return process")()`
 * yields the host `process` (the injected `agent` is a host function; its `.constructor.constructor` is the
 * HOST `Function`, evaluated in the host realm where code-generation is unrestricted). The
 * `codeGeneration:{strings:false}` below hardens the vm context's OWN eval/Function but CANNOT close that
 * constructor-chain escape — see `test/workflow-vm-escape.test.ts`, which PROVES the escape so no one ever
 * mistakes this for a sandbox.
 *
 * Therefore `safeForUntrustedScripts === false`: the S8 self-orchestration gate (design/98 §C) refuses to
 * mount `run_workflow` with this runner. An LLM-authored script REQUIRES a runner whose
 * `safeForUntrustedScripts === true` (isolated-vm / separate process + container), supplied by the deployment
 * or a separate `@ai-only/workflow-sandbox` package. Core ships this dev runner + the conformance contract a
 * hard runner must pass ({@link import("./workflow-sandbox-conformance.js").assertWorkflowSandboxConformance}).
 */
import type { WorkflowScriptRunner } from "./workflow-script-runner.js";
export declare const WORKFLOW_DATE_ERR = "Date.now() / new Date() are unavailable in workflow scripts (breaks resume). Stamp results after the workflow returns, or pass timestamps via args.";
export declare const WORKFLOW_RANDOM_ERR = "Math.random() is unavailable in workflow scripts (breaks resume). For N independent samples, include the index in the agent label or prompt.";
export declare const devWorkflowScriptRunner: WorkflowScriptRunner;